IIS 6.0的WEB管理接口存在多个问题

韩冰

Microsoft IIS 6.0的WEB管理接口存在多个问题，远程攻击者可以利用这个漏洞进行跨站脚...
: n7 {' c1 u' b! l9 ?3 A3 T! n4 f8 Y来源：CNCERT 2003-08-01


CNCVE编号：CNCVE-20031438
3 w8 F7 W( x* I$ P
CVE编号：
6 q) V+ O) n2 M% N' b3 R
# I  M9 L6 X: v0 A安全级别：高
1 J7 n1 c; W) N1 V8 s% V( c
漏洞中文描述：
1 }  {  f, I' O0 o! w) [Microsoft IIS 6.0的WEB管理接口存在多个问题，远程攻击者可以利用这个漏洞进行跨站脚本攻击，获得合法会话ID或未授权访问部分资源。

漏洞英文描述：
% `$ [8 R4 q0 q2 _$ Z3 b' ~+ ^Multiple vulnerabilities have been reported in the web admin interface that is included in Microsoft IIS 6.0. This includes multiple instances of cross-site scripting vulnerabilities. Additionally, it is reported that the web admin interface could expose valid session IDs or permit unauthorized access to areas that do not require session IDs.
/ e$ _- c" M' E; }" |# j
漏洞参考：
http://www.securityfocus.com/bid/8244
# H* G$ ]: }) g8 g- G9 h$ I* _# I
6 e( ?0 H: ^( l  r" V4 Q- J6 z系统类型： Win2000/NT

漏洞类型：其他

ilikenba

Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: vuldb@securityfocus.com