Vulnerability Name:

CVE-2000-1105 (CCN-5502)

Summary:The ixsso.query ActiveX Object is marked as safe for scripting, which allows malicious web site operators to embed a script that remotely determines the existence of files on visiting Windows 2000 systems that have Indexing Services enabled.
CVSS v3 Severity:3.7 Low (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): High
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): Low
Integrity (I): None
Availibility (A): None
CVSS v2 Severity:4.3 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Authentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): None
Availibility (A): None
2.6 Low (CCN CVSS v2 Vector: AV:N/AC:H/Au:N/C:P/I:N/A:N)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): High
Athentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): None
Availibility (A): None
Vulnerability Type:CWE-Other
Vulnerability Consequences:Obtain Information
References:Source: CCN
Type: BugTraq Mailing List, Fri Nov 10 2000 - 11:23:22 CST
IE 5.x Win2000 Indexing service vulnerability

Source: WIN2KSEC
Type: Exploit, Patch, Vendor Advisory
20001110 IE 5.x Win2000 Indexing service vulnerability

Source: MITRE
Type: CNA

Source: CCN
Type: US-CERT VU#829845
Microsoft Windows 2000 Indexing Services enumerates local file locations via ixsso.query ActiveX object

Source: CCN
Type: Microsoft Security Bulletin MS00-098
Patch Available for 'Indexing Service File Enumeration' Vulnerability

Source: CCN
Type: OSVDB ID: 10979
ixsso.query ActiveX Object Arbitrary File Existence Verification

20001110 IE 5.x Win2000 Indexing service vulnerability

Source: BID
Type: Exploit, Patch, Vendor Advisory

Source: CCN
Type: BID-1933
Microsoft Indexing Services for Windows 2000 File Verification Vulnerability

Source: XF

Vulnerable Configuration:Configuration 1:
  • cpe:/a:microsoft:indexing_service:*:*:windows_2000:*:*:*:*:*

  • Configuration CCN 1:
  • cpe:/a:microsoft:internet_explorer:5.0:*:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_2000:*:*:*:*:*:*:*:*
  • OR cpe:/a:microsoft:internet_explorer:5.5:preview:*:*:*:*:*:*
  • OR cpe:/a:microsoft:outlook:*:*:*:*:*:*:*:*
  • OR cpe:/a:microsoft:outlook_express:*:*:*:*:*:*:*:*
  • OR cpe:/a:microsoft:internet_explorer:5.5:-:*:*:*:*:*:*
  • OR cpe:/a:microsoft:internet_explorer:5.5:sp1:*:*:*:*:*:*
  • OR cpe:/a:microsoft:internet_explorer:5.1:*:*:*:*:*:*:*
  • OR cpe:/a:microsoft:internet_explorer:5.5:sp2:*:*:*:*:*:*
  • OR cpe:/a:microsoft:internet_explorer:5.0.1:-:*:*:*:*:*:*
  • OR cpe:/a:microsoft:internet_explorer:5.0.1:sp1:*:*:*:*:*:*
  • OR cpe:/a:microsoft:internet_explorer:5.0.1:sp2:*:*:*:*:*:*
  • OR cpe:/a:microsoft:internet_explorer:5.0.1:sp3:*:*:*:*:*:*
  • OR cpe:/a:microsoft:internet_explorer:5.0.1:sp4:*:*:*:*:*:*

  • * Denotes that component is vulnerable
    microsoft indexing service *
    microsoft ie 5.0
    microsoft windows 2000 *
    microsoft ie 5.5 preview
    microsoft outlook *
    microsoft outlook express *
    microsoft ie 5.5
    microsoft ie 5.5 sp1
    microsoft ie 5.1
    microsoft ie 5.5 sp2
    microsoft ie 5.0.1
    microsoft ie 5.0.1 sp1
    microsoft ie 5.0.1 sp2
    microsoft ie 5.0.1 sp3
    microsoft ie 5.0.1 sp4