Vulnerability Name:

CVE-1999-0777 (CCN-3305)

Assigned:1999-09-23
Published:1999-09-23
Updated:2018-10-12
Summary:IIS FTP servers may allow a remote attacker to read or delete files on the server, even if they have "No Access" permissions.
CVSS v3 Severity:7.3 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): Low
Integrity (I): Low
Availibility (A): Low
CVSS v2 Severity:7.5 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
7.5 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
Vulnerability Type:CWE-264
Vulnerability Consequences:File Manipulation
References:Source: MITRE
Type: CNA
CVE-1999-0777

Source: MSKB
Type: UNKNOWN
Q241407

Source: MSKB
Type: UNKNOWN
Q242559

Source: CCN
Type: Microsoft Security Bulletin MS01-041
Malformed RPC Request Can Cause Service Failure

Source: CCN
Type: Microsoft Security Bulletin MS02-001
Trusting Domains Do Not Verify Domain Membership of SIDs in Authorization Data

Source: CCN
Type: Microsoft Security Bulletin MS02-018
Cumulative Patch for Internet Information Services (Q319733)

Source: CCN
Type: Microsoft Security Bulletin MS02-062
Cumulative Patch for Internet Information Service (Q327696)

Source: CCN
Type: Microsoft Security Bulletin MS03-018
Cumulative Patch for Internet Information Service (811114)

Source: CCN
Type: Microsoft Security Bulletin MS99-039
Patch Available for 'Domain Resolution' and 'FTP Download' Vulnerabilities

Source: CCN
Type: OSVDB ID: 1083
Microsoft IIS FTP NO ACCESS Read/Delete File

Source: BID
Type: UNKNOWN
658

Source: CCN
Type: BID-658
Microsoft IIS FTP NO ACCESS Read/Delete File Vulnerability

Source: MS
Type: UNKNOWN
MS99-039

Source: XF
Type: UNKNOWN
iis-ftp-no-access-files(3305)

Source: CCN
Type: Microsoft Knowledge Base Article 241407
Files on an FTP Server Can Be Improperly Accessed

Source: CCN
Type: Microsoft Knowledge Base Article 241805
Combined FTP and Domain Restriction Security Patch for IIS 4.0

Source: CCN
Type: Microsoft Knowledge Base Article 242559
Files on an FTP Server Are Improperly Accessed

Vulnerable Configuration:Configuration 1:
  • cpe:/a:microsoft:commercial_internet_system:2.5:*:*:*:*:*:*:*
  • OR cpe:/a:microsoft:internet_information_services:4.0:*:*:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:microsoft:commercial_internet_system:2.5:*:*:*:*:*:*:*
  • OR cpe:/a:microsoft:internet_information_services:4.0:*:*:*:*:*:*:*
  • AND
  • cpe:/o:microsoft:windows_nt:4.0:*:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_nt:3.5.1:sp5:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_2000:*:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    BACK
    microsoft commercial internet system 2.5
    microsoft internet information server 4.0
    microsoft commercial internet system 2.5
    microsoft internet information server 4.0
    microsoft windows nt 4.0
    microsoft windows nt 3.5.1 sp5
    microsoft windows 2000 *