Bugtraq mailing list archives

Re: IIS still revealing paths for web directories

From: antonior () HISPASEC COM (Antonio Ropero)
Date: Sat, 15 Jan 2000 14:35:30 +0100


Hi,
To solve this problem check in the propierties of the web server
the option "Check that file exists", in
Home Directory/Application Settings/Configuration/App Mappings in
the Edit Window of the .ida and .idq extensions.
Both extensions are interpreted by idq.dll.

Antonio Ropero
antonior () hispasec com
HispaSec
http://www.hispasec.com

----- Original Message -----
From: Chris Tobkin <tobkin () SOFTWARE UMN EDU>
To: <BUGTRAQ () SECURITYFOCUS COM>
Sent: miércoles 12 de enero de 2000 21:07
Subject: Re: [BUGTRAQ] IIS still revealing paths for web
directories

The same problem still exists on IIS4 (tested with SP5 -

didn't try on

SP6).


Still exists as far back as IIS3 also. (SP6a)

Error "The IDQ file x:\web_home_dir\anything.idq could not be

found. "

(0xc000203e) encountered while processing the query

"<%CIRESTRICTION%>".


// chris
tobkin () umn edu

*****************************************************************
********

Chris Tobkin

tobkin () umn edu

Java and Web Services - Academic and Distributed Computing

Services - UMN

Shep. Labs 190

Minneapolis, MN 55455

             ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~
        "Nothing great was ever achieved without enthusiasm."
        - Ralph Waldo Emerson, poet, writer, and philosopher

*****************************************************************
********

Current thread:

Rh 6.1 initial root password encryption, (continued)
- - - Rh 6.1 initial root password encryption Ken Barber (Jan 20)
    - Re: Rh 6.1 initial root password encryption Fabian Kroenner (Jan 22)
    - Re: Crafted Packets Handling by Firewalls - FW-1 case Darren Reed (Jan 20)
    - Microsoft Security Bulletin (MS00-005) Microsoft Product Security (Jan 17)
    - Re: Microsoft Security Bulletin (MS00-005) bugtraq () NS DOOMSDAY COM (Jan 19)
    - Re: Microsoft Security Bulletin (MS00-005) Matt Davis (Jan 19)
    - Re: Microsoft Security Bulletin (MS00-005) Tabor J. Wells (Jan 19)
    - Unixware ppptalk what's your style? (Jan 19)
    - Re: Unixware ppptalk Andrew Malcolm (Jan 21)
    - Re: IIS still revealing paths for web directories Henrik Nordstrom (Jan 15)
    - Re: IIS still revealing paths for web directories Antonio Ropero (Jan 15)
    - Re: IIS still revealing paths for web directories Chris Tobkin (Jan 18)
    - SRS Addendum Matt Conover (Jan 12)
    - Re: IIS still revealing paths for web directories Georgi Guninski (Jan 13)
    - Re: IIS still revealing paths for web directories Scott Buchanan (Jan 13)
    - Re: IIS still revealing paths for web directories Taneli Huuskonen (Jan 15)
    - Fwd: Crash identified in Notes, Domino, and MTA with Date Conversio ns Xander Teunissen (Jan 14)
    - Re: IIS still revealing paths for web directories Norbert Luckhardt (Jan 15)
    - usual iploggers miss some variable stealth scans vecna (Jan 17)
    - Re: usual iploggers miss some variable stealth scans Simple Nomad (Jan 17)
    - AW: usual iploggers miss some variable stealth scans Tobi (Jan 18)

(Thread continues...)