Detections
Analytics

Microsoft IIS newdsn.exe Arbitrary File Creation

high Nessus Plugin ID 10360

Synopsis

The remote service is vulnerable to an access control breach.

Description

The CGI /scripts/tools/newdsn.exe is present.

This CGI allows any attacker to create files anywhere on your system if your NTFS permissions are not tight enough, and can be used to overwrite DSNs of existing databases.

Solution

Remove newdsn.exe

See Also

https://seclists.org/bugtraq/1997/Sep/70

Plugin Details

Severity: High

ID: 10360

File Name: newdsn.nasl

Version: 1.31

Type: remote

Family: CGI abuses

Published: 4/1/2000

Updated: 1/19/2021

Configuration: Enable paranoid mode

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 5.0

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.2

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Vulnerability Information

Required KB Items: Settings/ParanoidReport, www/iis

Vulnerability Publication Date: 8/27/1997

Reference Information

CVE: CVE-1999-0191

BID: 1818