Detections
Analytics

MS00-086: Webserver file request parsing (277873)

critical Nessus Plugin ID 10632

Synopsis

Arbitrary code can be executed on the remote host.

Description

The hotfix for the 'Webserver file request parsing' problem has not been applied.

This vulnerability can allow an attacker to execute arbitrary commands through the remote IIS server.

Solution

Microsoft has released a set of patches for IIS 4.0 and 5.0.

See Also

https://docs.microsoft.com/en-us/security-updates/SecurityBulletins/2000/ms00-086

Plugin Details

Severity: Critical

ID: 10632

File Name: smb_nt_ms00-086.nasl

Version: 1.47

Type: local

Agent: windows

Published: 3/12/2001

Updated: 11/15/2018

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.7

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

CPE: cpe:/o:microsoft:windows, cpe:/a:microsoft:iis

Required KB Items: SMB/MS_Bulletin_Checks/Possible

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 11/6/2000

Vulnerability Publication Date: 11/7/2000

Reference Information

CVE: CVE-2000-0886

BID: 1912

MSFT: MS00-086

MSKB: 277873