CVE-2000-0770

Published: Oct 20, 2000Modified: Apr 16, 2026

6.4

Vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Exploitability: 10.0 / Impact: 4.9

Source: NVD

Description

IIS 4.0 and 5.0 does not properly restrict access to certain types of files when their parent folders have less restrictive permissions, which could allow remote attackers to bypass access restrictions to some files, aka the "File Permission Canonicalization" vulnerability.

Affected (2)

Products: Microsoft: Internet Information Server, Internet Information Services

2 products

Internet Information Server

Internet Information Services

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Microsoft Internet Information Server	Version 4.0
Microsoft Internet Information Services	Version 5.0

References (4)

http://www.securityfocus.com/bid/1565

Source: cve@mitre.org

PatchVendor Advisory

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2000/ms00-057

Source: cve@mitre.org

http://www.securityfocus.com/bid/1565

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2000/ms00-057

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.