Insecure Log File Permissions in Microsoft Internet Information Server

CVE-2002-1694

Summary

Microsoft Internet Information Server (IIS) 4.0 contains a vulnerability where log files are created with FILE_SHARE_READ and FILE_SHARE_WRITE permissions. This configuration may allow unauthorized remote attackers to alter the contents of active log files while the server is running. Such modifications could lead to misrepresentation of access records, evasion of detection measures, and further compromises of server security. It is critical for administrators to review their server's logging configurations to prevent potential exploitation.

References