CVE-1999-1537

IIS 3.x and 4.x does not distinguish between pages requiring encryption and those that do not, which allows remote attackers to cause a denial of service (resource exhaustion) via SSL requests to the HTTPS port for normally unencrypted files, which will cause IIS to perform extra work to send the files over SSL.

CVSS v2.0 5.0 MEDIUM

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:N/I:N/A:P

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact PARTIAL

References

Link	Resource
http://marc.info/?l=ntbugtraq&m=93138827329577&w=2
http://www.securityfocus.com/bid/521	Patch Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/2352
http://marc.info/?l=ntbugtraq&m=93138827329577&w=2
http://www.securityfocus.com/bid/521	Patch Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/2352

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:microsoft:internet_information_server:3.0:::::::*
	cpe:2.3:a:microsoft:internet_information_server:4.0:::::::*

History

20 Nov 2024, 23:31

Type	Values Removed	Values Added
References	~~() http://marc.info/?l=ntbugtraq&m=93138827329577&w=2 -~~	() http://marc.info/?l=ntbugtraq&m=93138827329577&w=2 -
References	~~() http://www.securityfocus.com/bid/521 - Patch, Vendor Advisory~~	() http://www.securityfocus.com/bid/521 - Patch, Vendor Advisory
References	~~() https://exchange.xforce.ibmcloud.com/vulnerabilities/2352 -~~	() https://exchange.xforce.ibmcloud.com/vulnerabilities/2352 -

Information

Published : 1999-07-07 04:00

Updated : 2024-11-20 23:31

NVD link : CVE-1999-1537

Mitre link : CVE-1999-1537

CVE.ORG link : CVE-1999-1537

JSON object : View

Products Affected

microsoft

internet_information_server

CWE

NVD-CWE-Other

{"id": "CVE-1999-1537", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "1999-07-07T04:00:00.000", "references": [{"url": "http://marc.info/?l=ntbugtraq&m=93138827329577&w=2", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/521", "tags": ["Patch", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/2352", "source": "cve@mitre.org"}, {"url": "http://marc.info/?l=ntbugtraq&m=93138827329577&w=2", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securityfocus.com/bid/521", "tags": ["Patch", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/2352", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "IIS 3.x and 4.x does not distinguish between pages requiring encryption and those that do not, which allows remote attackers to cause a denial of service (resource exhaustion) via SSL requests to the HTTPS port for normally unencrypted files, which will cause IIS to perform extra work to send the files over SSL."}], "lastModified": "2024-11-20T23:31:21.257", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:internet_information_server:3.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "547AB6E2-4E9F-4783-8BB4-0AE297A38C9C"}, {"criteria": "cpe:2.3:a:microsoft:internet_information_server:4.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5D47E9C4-5439-4A82-BBD8-D6B482B47E51"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}