CVE-2000-0884

Description

IIS 4.0 and 5.0 allows remote attackers to read documents outside of the web root, and possibly execute arbitrary commands, via malformed URLs that contain UNICODE encoded characters, aka the "Web Server Folder Traversal" vulnerability.

Affected products

• microsoft / internet_information_server4.0 – 4.0
• microsoft / internet_information_services5.0 – 5.0

Exploits & proofs of concept

• exploit-dbMicrosoft IIS 4.0/5.0 and PWS - Extended Unicode Directory Traversal (9)by Optyx
• exploit-dbMicrosoft IIS 4.0/5.0 and PWS - Extended Unicode Directory Traversal (8)by Roelof Temmingh
• exploit-dbMicrosoft IIS 4.0/5.0 and PWS - Extended Unicode Directory Traversal (7)by steeLe
• exploit-dbMicrosoft IIS 4.0/5.0 and PWS - Extended Unicode Directory Traversal (6)by incubus
• exploit-dbMicrosoft IIS 4.0/5.0 and PWS - Extended Unicode Directory Traversal (2)by Roelof Temmingh
• exploit-dbMicrosoft IIS 4.0/5.0 and PWS - Extended Unicode Directory Traversal (5)by Andrea Spabam
• exploit-dbMicrosoft IIS 4.0/5.0 and PWS - Extended Unicode Directory Traversal (4)by BoloTron
• exploit-dbMicrosoft IIS 4.0/5.0 and PWS - Extended Unicode Directory Traversal (3)by zipo
• exploit-dbMicrosoft IIS 4.0/5.0 and PWS - Extended Unicode Directory Traversal (1)by Gabriel Maggiotti

References

• MISChttps://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A44
• MISChttps://docs.microsoft.com/en-us/security-updates/securitybulletins/2000/ms00-078
• MISChttps://exchange.xforce.ibmcloud.com/vulnerabilities/5377
• MISChttp://www.securityfocus.com/bid/1806
• MISChttp://www.osvdb.org/436