MS00-019: Microsoft IIS ISAPI Virtual Directory UNC Mapping ASP Source Disclosure (uncredentialed check)

It is possible to get the source code of the remote ASP scripts which are hosted on a mapped network share by appending '%5c' to the end of the request. ASP source code usually contains sensitive information such as logins and passwords. %NASLMINLEVEL 70300 [email protected] http://libpcap.net See...

MS Windows WebDAV (ntdll.dll) Remote Exploit

Exploit for unknown platform in category remote exploits ============================================ MS Windows WebDAV ntdll.dll Remote Exploit ============================================ // / Crpt ntdll.dll exploit trough WebDAV by kralor Crpt / /...

CVE-2003-0109

Buffer overflow in ntdll.dll on Microsoft Windows NT 4.0, Windows NT 4.0 Terminal Server Edition, Windows 2000, and Windows XP allows remote attackers to execute arbitrary code, as demonstrated via a WebDAV request to IIS 5.0...

CVE-2003-0109

CVE-2003-0109 is a remote code execution flaw caused by a buffer overflow in the Windows NTDLL.DLL when processing a WebDAV request to IIS 5.0. The vulnerability affects Windows NT 4.0/Terminal Server, Windows 2000, and Windows XP, with confirmed exploit examples and public PoCs (e.g., MS03-007) ...

MS03-007: Unchecked Buffer in ntdll.dll (815021)

The remote version of Windows contains a buffer overflow in the Windows kernel, that could allow an attacker to execute arbitrary code on the remote host with SYSTEM privileges. For example this vulnerability can be exploited through the WebDAV component of IIS 5.0. A public exploit is available....

Microsoft IIS WebDAV ntdll.dll Remote Overflow (MS03-007)

The remote WebDAV server is vulnerable to a buffer overflow when it receives a too long request. An attacker may use this flaw to execute arbitrary code within the LocalSystem security context. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. Tested on : W2K SP3 + the fix - IIS issues an erro...

CERT Advisory CA-2003-09 Buffer Overflow in Microsoft IIS 5.0

-----BEGIN PGP SIGNED MESSAGE----- CERT Advisory CA-2003-09 Buffer Overflow in Microsoft IIS 5.0 Original issue date: March 17, 2003 Last revised: -- Source: CERT/CC A complete revision history is at the end of this file. Systems Affected Systems running Microsoft Windows 2000 with IIS 5.0 enable...

ISS Security Brief: Microsoft IIS WebDAV Remote Compromise Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Internet Security Systems Security Brief March 17, 2003 Microsoft IIS WebDAV Remote Compromise Vulnerability Synopsis: A serious vulnerability exists within the WebDAV component of Microsoft Internet Information Services IIS Web server. WebDAV stands for...

Microsoft IIS 5.0 (Windows XP/2000/NT 4.0) - WebDAV 'ntdll.dll' Remote Buffer Overflow (4)

source: https://www.securityfocus.com/bid/7116/info The Windows library ntdll.dll includes a function that does not perform sufficient bounds checking. The vulnerability is present in the function "RtlDosPathNameToNtPathNameU" and may be exploited through other programs that use the library if an...

Microsoft IIS 5.0 (Windows XP2000NT 4.0) - WebDAV ntdll.dll Remote Buffer Overflow (4)

Microsoft IIS 5.0 Windows XP2000NT 4.0 - WebDAV ntdll.dll Remote Buffer Overflow 4 source: https://www.securityfocus.com/bid/7116/info The Windows library ntdll.dll includes a function that does not perform sufficient bounds checking. The vulnerability is present in the function...

ColdFusion on IIS cfm/dbm Diagnostic Error Path Disclosure

It was possible to make the remote web server disclose the physical path to its web root by requesting a MS-DOS device ending in .dbm as in nul.dbm. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. This script was written by Renaud Deraison Modified by Paul Johnston for Westpoint Ltd to displ...

Microsoft IIS shtml.dll XSS

The version of the FrontPage extensions running on the remote web server is affected by a cross-site scripting XSS vulnerability in shtml.dll due to improper validation of filenames. An unauthenticated, remote attacker can exploit this, by convincing a user to follow a specially crafted URL, to...

Microsoft IIS fpcount.exe CGI Remote Overflow

Nessus detected the 'fpcount.exe' CGI on the remote web server. Some versions of this CGI have a remote buffer overflow vulnerability. A remote attacker could exploit it to crash the web server, or possibly execute arbitrary code. Nessus did not actually check for this flaw, but solely relied on...

Cross Site Scripting Advisory.

uk2sec Cross Site Scripting Advisory by c0wd0g3 [email protected] Many many websites run a 'site search' tool on their webpage with a URL that looks like this: /search/index.cfm I am having trouble locating a specific vendor, but according to windows the possible applications that may run it...

CVE-2002-1876

Microsoft Exchange 2000 allows remote authenticated attackers to cause a denial of service via a large number of rapid requests, which consumes all of the licenses that are granted to Exchange by IIS...

CVE-2002-1992

Buffer overflow in jrun.dll in ColdFusion MX, when used with IIS 4 or 5, allows remote attackers to cause a denial of service in IIS via 1 a long template file name or 2 a long HTTP header...

CVE-2002-1908

Microsoft IIS 5.0 and 5.1 allows remote attackers to cause a denial of service CPU consumption via an HTTP request with a Host header that contains a large number of "/" forward slash characters...

CVE-2002-1694

Microsoft Internet Information Server IIS 4.0 opens log files with FILESHAREREAD and FILESHAREWRITE permissions, which could allow remote attackers to modify the log file contents while IIS is running...

CVE-2002-1744

Directory traversal vulnerability in CodeBrws.asp in Microsoft IIS 5.0 allows remote attackers to view source code and determine the existence of arbitrary files via a hex-encoded "%c0%ae%c0%ae" string, which is the Unicode representation for ".." dot dot...

CVE-2002-1745

Off-by-one error in the CodeBrws.asp sample script in Microsoft IIS 5.0 allows remote attackers to view the source code for files with extensions containing with one additional character after .html, .htm, .asp, or .inc, such as .aspx files...