Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
2.6
CVE-2000-0649: IIS 4.0 may expose server's internal IP address
CVE-2000-0649 · published 26 years ago
Summary
Microsoft's Internet Information Services version 4.0 can disclose the server's internal network address when someone requests a password‑protected page without a defined realm. This could let attackers learn details about your internal network layout. Upgrade to a newer IIS version or apply the latest security updates to stop the information leak.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| microsoft | internet_information_server |
3.0 4.0 cpe:2.3:a:microsoft:internet_information_server:3.0:*:*:*:*:*:*:* |
| microsoft | internet_information_services |
2.0 5.0 cpe:2.3:a:microsoft:internet_information_services:2.0:*:*:*:*:*:*:* |
Original advisory text
IIS 4.0 allows remote attackers to obtain the internal IP address of the server via an HTTP 1.0 request for a web page which is protected by basic authentication and has no realm defined.
IIS 4.0 allows remote attackers to obtain the internal IP address of the server via an HTTP 1.0 request for a web page which is protected by basic authentication and has no realm defined.
References
- http://archives.neohapsis.com/archives/ntbugtraq/2000-q3/0025.html Exploit Patch Vendor Advisory
- http://www.securityfocus.com/bid/1499 Exploit Patch Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Severity
2.6
Low
Type
CWE-200Information Exposure
Timeline
Published13 Jul 2000
Updated29 Sep 2026
First seen29 Sep 2026
Sources
CVE-2000-0649 · NVD
Track software like this
Free during beta