iisDoS.txt

Internet Information Services 5.0 Denial of service Release Date May 29th, 2003 Severity: High Systems Affected Microsoft Information Server 5.0 Microsoft Information Server 5.1 Description If an attacker sends a Webdav request with a body over 49,153 bytes using the 'PROPFIND' or 'SEARCH' reques...

CVE-2002-0072

CVE-2002-0072 describes a denial-of-service in Microsoft IIS 4.0/5.0/5.1 caused by the w3svc.dll FP2002/ISAPI filter when handling an overly long URL. The error handling rewrites a URL to a null value and then dereferences it, crashing Inetinfo.exe. Affected components: FP2002 Front Page Server E...

CVE-2002-0071

Buffer overflow in the ism.dll ISAPI extension that implements HTR scripting in Internet Information Server IIS 4.0 and 5.0 allows attackers to cause a denial of service or execute arbitrary code via HTR requests with long variable names...

CVE-2002-0072

The w3svc.dll ISAPI filter in Front Page Server Extensions and ASP.NET for Internet Information Server IIS 4.0, 5.0, and 5.1 does not properly handle the error condition when a long URL is provided, which allows remote attackers to cause a denial of service crash when the URL parser accesses a nu...

CVE-2002-0074

Cross-site scripting vulnerability in Help File search facility for Internet Information Server IIS 4.0, 5.0 and 5.1 allows remote attackers to embed scripts into another user's session...

CVE-2002-0075

Cross-site scripting vulnerability for Internet Information Server IIS 4.0, 5.0 and 5.1 allows remote attackers to execute arbitrary script as other web users via the error message used in a URL redirect ""302 Object Moved" message...

CVE-2002-0148

Cross-site scripting vulnerability in Internet Information Server IIS 4.0, 5.0 and 5.1 allows remote attackers to execute arbitrary script as other users via an HTTP error page...

CVE-2002-0150

Buffer overflow in Internet Information Server IIS 4.0, 5.0, and 5.1 allows remote attackers to spoof the safety check for HTTP headers and cause a denial of service or execute arbitrary code via HTTP header field values...

CVE-2002-0147

Buffer overflow in the ASP data transfer mechanism in Internet Information Server IIS 4.0, 5.0, and 5.1 allows remote attackers to cause a denial of service or execute code, aka "Microsoft-discovered variant of Chunked Encoding buffer overrun."...

CVE-2002-0079

The CVE-2002-0079 issue is a heap/buffer overflow in the ASP ISAPI filter of Microsoft IIS (4.0/5.0) triggered by chunked-encoded POST data in ASP pages. Public writeups (SAINT) describe remote exploitation causing crashes in dllhost.exe or arbitrary code execution on IIS 5.0, with a patch refere...

CVE-2002-0079

Buffer overflow in the chunked encoding transfer mechanism in Internet Information Server IIS 4.0 and 5.0 Active Server Pages allows attackers to cause a denial of service or execute arbitrary code...

CVE-2002-0073

The FTP service in Internet Information Server IIS 4.0, 5.0 and 5.1 allows attackers who have established an FTP session to cause a denial of service via a specially crafted status request containing glob characters...

CVE-2002-0073: Undefined Security Weakness

The FTP service in Internet Information Server IIS 4.0, 5.0 and 5.1 allows attackers who have established an FTP session to cause a denial of service via a specially crafted status request containing glob characters...

CVE-2002-0150: Undefined Security Weakness

Buffer overflow in Internet Information Server IIS 4.0, 5.0, and 5.1 allows remote attackers to spoof the safety check for HTTP headers and cause a denial of service or execute arbitrary code via HTTP header field values...

CVE-2002-0147: Undefined Security Weakness

Buffer overflow in the ASP data transfer mechanism in Internet Information Server IIS 4.0, 5.0, and 5.1 allows remote attackers to cause a denial of service or execute code, aka "Microsoft-discovered variant of Chunked Encoding buffer overrun."...

CVE-2002-0072: Undefined Security Weakness

The w3svc.dll ISAPI filter in Front Page Server Extensions and ASP.NET for Internet Information Server IIS 4.0, 5.0, and 5.1 does not properly handle the error condition when a long URL is provided, which allows remote attackers to cause a denial of service crash when the URL parser accesses a nu...

CVE-2002-0074: Undefined Security Weakness

Cross-site scripting vulnerability in Help File search facility for Internet Information Server IIS 4.0, 5.0 and 5.1 allows remote attackers to embed scripts into another user's session...

CVE-2002-0071: Undefined Security Weakness

Buffer overflow in the ism.dll ISAPI extension that implements HTR scripting in Internet Information Server IIS 4.0 and 5.0 allows attackers to cause a denial of service or execute arbitrary code via HTR requests with long variable names...

CVE-2002-0148: Undefined Security Weakness

Cross-site scripting vulnerability in Internet Information Server IIS 4.0, 5.0 and 5.1 allows remote attackers to execute arbitrary script as other users via an HTTP error page...

CVE-2002-0075: Undefined Security Weakness

Cross-site scripting vulnerability for Internet Information Server IIS 4.0, 5.0 and 5.1 allows remote attackers to execute arbitrary script as other web users via the error message used in a URL redirect ""302 Object Moved" message...