CVE-2003-0105 ServerMask 2.2 and earlier does not obfuscate (1) ETag, (2) HTTP Status Message, or (3) Allow HTTP responses, which could tell remote attackers that the web server is an IIS server.
MediumCVSS 5.0
EPSS 2.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
ServerMask 2.2 and earlier does not obfuscate (1) ETag, (2) HTTP Status Message, or (3) Allow HTTP responses, which could tell remote attackers that the web server is an IIS server.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| port80 software servermask | <= 2.2 | No fix listed |
References
- 20040810 Corsaire Security Advisory - Port80 Software ServerMask inconsistencies mailing-list
- www.corsaire.com vendor-advisory
- servermask-header-obtain-info(16947) vdb-entry