`"Absent Directory Browser Argument" DoS
Advisory Code: VIGILANTE-2000003
July 15, 2000
Internet Information Server 4.0 for NT (upgraded from IIS 3.0)
Internet Information Server 5.0 for NT (upgraded from IIS 3.0)
A system with Internet Information Server 4.0 or 5.0 that was upgraded from
3.0, contains unused remains from 3.0 due to functionality changes in 4.0.
Since it's easy to "accidentally" install 3.0 when you install the server,
there is bound to be quite a few systems out there that haven't cleaned out
the no longer used scripts and thus are vulnerable.
Issuing a malformed request for a certain file contained in
/scripts/iisadmin can result in the webserver going into to an infinite
loop, causing the web server to no longer accept requests. The service will
continue to "pick up" on TCP port 80 (or where ever you installed it), but
will not honour HTTP requests. During testing of this, it was usually
necessary to reboot the machine in order for IIS to start working again,
simply attempting to stop and start inetinfo did not work.
Initially reported on the 24th of May this year. Microsoft has released the
following bulletin concerning the issue, including a patch:
Internet Information Server 4.0:
Internet Information Server 5.0:
Vendor URL: http://www.microsoft.com
Internet Information Server 4.0 URL:
Internet Information Server 5.0 URL:
Copyright VIGILANTe 2000-07-15
The information within this document may change without notice. Use of
this information constitutes acceptance for use in an AS IS
condition. There are NO warranties with regard to this information.
In no event shall the author be liable for any consequences whatsoever
arising out of or in connection with the use or spread of this
information. Any use of this information lays within the user's
Please send suggestions, updates, and comments to: