Unspecified vulnerability in Microsoft Internet Information Services (IIS) 5.1 on Windows XP SP3, when directory-based Basic Authentication is enabled, allows remote attackers to bypass intended access restrictions and execute ASP files via a crafted request, aka "Directory Authentication Bypass Vulnerability."

According to the HTTP server banner the remote server is IIS 7.0. The server may be vulnerable to a number of vulnerabilities including a couple of remote code execution vulnerabilities.

The version of IIS installed on the remote host has the following vulnerabilities :

  - Sending a specially crafted request for an ASP page     on a website hosted by IIS can result in a denial of     service. (CVE-2010-1899)

  - Sending a specially crafted HTTP request to an IIS     server with FastCGI enabled can result in remote     code execution. (CVE-2010-2730)

  - Sending a specially crafted request to an IIS server     running on Windows XP can allow a remote attacker to     bypass the need to authenticate to access restricted     resources. (CVE-2010-2731)

The version of IIS 5.x installed on the remote host is affected by an authentication bypass vulnerability.  It is possible to access protected web directories without authentication through use of an Alternate Data Stream to open protected folders.

A remote, unauthenticated attacker can leverage this issue to gain access to protected web directories.

ID	Name	Product	Family	Type	Severity
108808	Microsoft IIS 7.0 Vulnerabilities (uncredentialed) (PCI/DSS)	Nessus	Web Servers	Remote	high
49223	MS10-065: Vulnerabilities in Microsoft Internet Information Services (IIS) Could Allow Remote Code Execution (2267960)	Nessus	Windows : Microsoft Bulletins	Local	medium
47594	IIS 5.x Alternate Data Stream Authentication Bypass	Nessus	CGI abuses	Remote	high

Detections

Analytics

CVE-2010-2731

critical

Tenable Plugins

high

medium

high