Vulnerability:Microsoft IIS 5.1 Frontpage Extensions Path Disclosure Information

Microsoft IIS 5.1 Frontpage Extensions Path Disclosure Information Vulnerabil

An issue has been reported that a number of configuration files (.cnf) in Microsoft IIS 5.1, could be used to disclose sensitive system information to remote users.


Allegedly, submitting a request for one of the vulnerable files by way of '/_vti_pvt/', will cause the host to reveal system path information. The reported problematic files are 'access.cnf', 'botinfs.cnf', 'bots.cnf' and 'linkinfo.cnf'.

Microsoft has not confirmed the existence of these vulnerabilities.

Remote: Yes

Exploit: No exploit code is required.

another M$ vulnerability.... y am i not surprise?

Glad you posted this one s0nIc. I have a client that has been having problems with IIS dumping the FP extentions at times due to buffer overflows. At least thats what the error logs show. I think this may be the culprit. I'll have to probe into this further. Thanks again.... :p