Microsoft IIS 4.0 - ISAPI Buffer Overflow

Microsoft IIS 4.0 - ISAPI Buffer Overflow source: https://www.securityfocus.com/bid/1911/info The ASP ISAPI file parser does not properly execute certain malformed ASP files that contain scripts with the LANGUAGE parameter containing a buffer of over 2200 characters and have the RUNAT value set a...

Microsoft IIS 4.0 - ISAPI Buffer Overflow

source: https://www.securityfocus.com/bid/1911/info The ASP ISAPI file parser does not properly execute certain malformed ASP files that contain scripts with the LANGUAGE parameter containing a buffer of over 2200 characters and have the RUNAT value set as 'server'. Depending on the data entered...

CVE-2000-0835

The CVE-2000-0835 issue affects Sambar Server 4.4 Beta 3 where the search.dll ISAPI Search utility allows remote reading of arbitrary directories by supplying a directory path in the query parameter. This causes information disclosure (confidentiality impact) without integrity or availability dis...

Security Bulletin (MS00-057)

Microsoft Security Bulletin MS00-057 - -------------------------------------- Patch Available for "File Permission Canonicalization" Vulnerability Originally posted: August 10, 2000 Summary ======= Microsoft has released a patch that eliminates a security vulnerability in Microsoftr Internet...

CVE-2000-0246

IIS 4.0 and 5.0 does not properly perform ISAPI extension processing if a virtual directory is mapped to a UNC share, which allows remote attackers to read the source code of ASP and other files, aka the "Virtualized UNC Share" vulnerability...

CVE-2000-0246

The vulnerability CVE-2000-0246 affects Microsoft IIS 4.0/5.0 where ISAPI extension processing fails for a virtual directory mapped to a UNC share, enabling remote attackers to read ASP source and other files. OpenVAS/Nessus entries confirm ASP/HTR source disclosure via UNC-path access. No remedi...

CVE-2000-0246: Undefined Security Weakness

IIS 4.0 and 5.0 does not properly perform ISAPI extension processing if a virtual directory is mapped to a UNC share, which allows remote attackers to read the source code of ASP and other files, aka the "Virtualized UNC Share" vulnerability...

RFP2K02.txt

----- UMBRA Advisory RFP2K02 -------------------------- rfp.labs --------- "Netscape engineers are weenies!" A back door in Microsoft FrontPage extensions/authoring components ------------------------------------- Alf Serer / [email protected] - rain forest puppy / [email protected] Table of...

RFP2K02: "Netscape engineers are weenies!"

----- UMBRA Advisory RFP2K02 -------------------------- rfp.labs --------- "Netscape engineers are weenies!" A back door in Microsoft FrontPage extensions/authoring components ------------------------------------- Alf Serer / [email protected] - rain forest puppy / [email protected] Table of...

CVE-2000-0246

IIS 4.0 and 5.0 does not properly perform ISAPI extension processing if a virtual directory is mapped to a UNC share, which allows remote attackers to read the source code of ASP and other files, aka the "Virtualized UNC Share" vulnerability...

CVE-2000-0097

The CVE-2000-0097 vulnerability concerns Microsoft IIS WebHits ISAPI Filter used with Microsoft Index Server. The OpenVAS Active Check entries reference MS00-06 and confirm that the WebHits filter allows remote attackers to read arbitrary files via crafted requests (Mal-formed Hit-Highlighting Ar...

CVE-2000-0097: Undefined Security Weakness

The WebHits ISAPI filter in Microsoft Index Server allows remote attackers to read arbitrary files, aka the "Malformed Hit-Highlighting Argument" vulnerability...

CVE-2000-0097

The WebHits ISAPI filter in Microsoft Index Server allows remote attackers to read arbitrary files, aka the "Malformed Hit-Highlighting Argument" vulnerability...

CVE-1999-0861

Race condition in the SSL ISAPI filter in IIS and other servers may leak information in plaintext...

CVE-1999-0861

CVE-1999-0861 describes a race condition in the SSL ISAPI filter used by IIS and other servers, which may leak information in plaintext. The connected materials reiterate the high-level description but do not specify affected products/versions, root cause details beyond “race condition,” or concr...

CVE-1999-0861: Concurrent Execution using Shared Resource with Improper Synchronization

Race condition in the SSL ISAPI filter in IIS and other servers may leak information in plaintext...

CVE-1999-0412

CVE-1999-0412 affects IIS and other web servers where the server runs as SYSTEM and loads an ISAPI extension. The underlying issue allows an attacker to execute commands with SYSTEM privileges via the ISAPI extension, enabling high-privilege access on the affected server. Connected documents corr...

CVE-1999-0412

In IIS and other web servers, an attacker can attack commands as SYSTEM if the server is running as SYSTEM and loading an ISAPI extension...

CVE-1999-0412: Undefined Security Weakness

In IIS and other web servers, an attacker can attack commands as SYSTEM if the server is running as SYSTEM and loading an ISAPI extension...

iis.system.isapi.txt

Date: Mon, 8 Mar 1999 11:27:48 -0500 From: Fabien Royer To: [email protected] Subject: ISAPI Extension vulnerability allows to execute code as SYSTEM There's a vulnerability in IIS and other WEB servers executing as SYSTEM that allows to execute an ISAPI extension in the security...