Nessus Plugin #10575

Plugin Index

Note: This file has been created from a downloaded version of the Nessus Plugins from http://www.nessus.org/. Therefore, the information here can be outdated.

Check for IIS .cnf file leakage

Family:

CGI abuses

Category:

infos

Copyright:

By John Lampe....j_lampe@bellsouth.net

Summary:

Check for existence of world-readable .cnf files

Version:

$Revision: 1.23 $

Cve_id:

-

Bugtraq_id:

4078

Xrefs:

-

Description:

The IIS web server may allow remote users to read sensitive information
from .cnf files. This is not the default configuration.

Example, http://target/_vti_pvt%5csvcacl.cnf, access.cnf,
svcacl.cnf, writeto.cnf, service.cnf, botinfs.cnf,
bots.cnf, linkinfo.cnf and services.cnf

See also : http://www.safehack.com/Advisory/IIS5webdir.txt
Solution: If you do not need .cnf files, then delete them, otherwise use
suitable access control lists to ensure that the .cnf files are not
world-readable by Anonymous users.

Risk factor : Medium