OSVDB ID: 630 Title: Microsoft IIS Multiple Malformed Header Field Internal IP Address Disclosure |
Info |
|
|
Dates |
||||
|
|
Description |
Microsoft IIS contains a flaw that may lead to an unauthorized information disclosure. The issue is triggered when attempting to access an area protected via basic HTTP authentication without providing realm information, making a request without a host: header, or by trying to access a resource that has been moved (302). This may disclose the internal IP address or network name in the response header resulting in a loss of confidentiality. |
Classification |
Location:
Remote / Network Access
Attack Type: Information Disclosure Impact: Loss of Confidentiality Exploit: Exploit Public Disclosure: OSVDB Verified OSVDB: Web Related |
Solution |
Currently, there are no known upgrades or patches to correct this issue. It is possible to correct the flaw by implementing the following workaround: Change the w3svc/UseHostName value (from False to True) in the metabase This is done my using the adsutil.vbs ot manually change values within the metabase. |
Products |
|
References |
|
Credit |
|
GUNTERS.ORG -