CVE-2002-0150

Buffer overflow in Internet Information Server IIS 4.0, 5.0, and 5.1 allows remote attackers to spoof the safety check for HTTP headers and cause a denial of service or execute arbitrary code via HTTP header field values...

CVE-2002-0075

Cross-site scripting vulnerability for Internet Information Server IIS 4.0, 5.0 and 5.1 allows remote attackers to execute arbitrary script as other web users via the error message used in a URL redirect ""302 Object Moved" message...

Multiple Remote Vulnerabilities in Microsoft IIS

TO UNSUBSCRIBE: email "unsubscribe alert" in the body of your message to [email protected] Contact [email protected] for help with any problems! --------------------------------------------------------------------------- -----BEGIN PGP SIGNED MESSAGE----- Internet Security Systems Security Aler...

[SNS Advisory No.49] A Possibility of Internet Information Server/Services Cross Site Scripting

---------------------------------------------------------------------- SNS Advisory No.49 A Possibility of Internet Information Server/Services Cross Site Scripting Problem first discovered: Fri, 11 Jan 2002 Published: Thu, 11 Apr 2002...

KPMG-2002009: Microsoft IIS W3SVC Denial of Service

-------------------------------------------------------------------- -=Microsoft IIS W3SVC Denial of Service=- courtesy of KPMG Denmark BUG-ID: 2002009 CVE: CAN-2002-0072 Released: 11th Apr 2002 -------------------------------------------------------------------- Problem: ======== A flaw in...

Multiple bugs in Microsoft Internet Information Server

Multiple buffer overflows, crossite scripting, DoS...

Microsoft Internet Information Server (IIS) vulnerable to DoS when URL request exceeds maximum allowed length

Overview Intruders may be able to cause the IIS service to fail by sending a particular kind of overly-long URL. Description ISAPI is a programming interface to IIS that can be used to modify or extend the behavior of IIS. Programs written using ISAPI are known as either filters or extension,...

Microsoft Internet Information Server (IIS) contains cross-site scripting vulnerability in redirect response messages

Overview Visitors to web sites that use Microsoft IIS and also issue redirect response messages are vulnerable to cross-site scripting attacks. Description Cross-site scripting is a form of attack in which an intruder leverages the trust between a victim and a web-site the victim trusts. Quoting...

Microsoft Internet Information Server (IIS) vulnerable to DoS via malformed FTP connection status request

Overview A vulnerability in IIS could allow an intruder to disrupt ordinary operations of both FTP and Web services on vulnerable IIS servers. Description IIS includes an FTP server. An intruder who sends a malformed request for the status of an existing connection could cause the IIS server to...

Multiple intrusion detection systems may be circumvented via %u encoding

Overview Multiple intrusion detection systems may be circumvented via %u encoding allowing intruders to launch attacks undetected. Description Most intrusion detection systems are capable of decoding URLs that are encoded using either the "UTF" or "hex-encode" encoding schemes. Microsoft's...

Security Bulletin MS00-100

Microsoft Security Bulletin MS00-100 Patch Available for “Malformed Web Form Submission” Vulnerability Originally posted: December 22, 2000 Summary Microsoft has released a patch that eliminates a security vulnerability in a component that ships as part of Microsoft® Internet Information Server...

Security Bulletin (MS00-080)

Microsoft Security Bulletin MS00-080 - -------------------------------------- Patch Available for "Session ID Cookie Marking" Vulnerability Originally posted: October 23, 2000 Summary ======= Microsoft has released a patch that eliminates a security vulnerability in Microsoftr Internet Informatio...

@stake Advisory: Unauthorized "Directory Listings" under IIS 5.0 (A100400-1)

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 @stake, Inc. www.atstake.com Security Advisory Advisory Name: Unauthorized "Directory Listings" under IIS 5.0 Release Date: 10/04/2000 Application: Internet Information Server 5.0 Platform: Windows 2000 Severity: An attacker can enumerate files in...

VIGILANTE-2000009.txt

"Invalid URL" DoS Advisory Code: VIGILANTE-2000009 Release Date: September 6, 2000 Systems Affected: - Internet Information Server 4.0 for Windows NT 4.0 - Possibly Windows NT 4.0 in general read Microsoft's note THE PROBLEM A certain series of requests can cause INETINFO.EXE to gradually consume...

Security Bulletin (MS00-063)

Microsoft Security Bulletin MS00-063 - -------------------------------------- Patch Available for "Invalid URL" Vulnerability Originally posted: September 05, 2000 Summary ======= Microsoft has released a patch that eliminates a security vulnerability in Microsoftr Internet Information Server IIS...

VIGILANTE-2000009: "Invalid URL" DoS

Microsoft Security Bulletin MS00-063 - -------------------------------------- Patch Available for "Invalid URL" Vulnerability Originally posted: September 05, 2000 Summary ======= Microsoft has released a patch that eliminates a security vulnerability in Microsoftr Internet Information Server IIS...

Security Bulletin (MS00-060)

Microsoft Security Bulletin MS00-060 - -------------------------------------- Patch Available for "IIS Cross-Site Scripting" Vulnerabilities Originally posted: August 25, 2000 Summary ======= Microsoft has released a patch that eliminates security vulnerabilities in Microsoftr Internet Informatio...

Security Bulletin (MS00-058)

Microsoft Security Bulletin MS00-058 - -------------------------------------- Patch Available for "Specialized Header" Vulnerability Originally posted: August 14, 2000 Summary ======= Microsoft has released a patch that eliminates a security vulnerability in Internet Information Server that ships...

Security Bulletin (MS00-057)

Microsoft Security Bulletin MS00-057 - -------------------------------------- Patch Available for "File Permission Canonicalization" Vulnerability Originally posted: August 10, 2000 Summary ======= Microsoft has released a patch that eliminates a security vulnerability in Microsoftr Internet...

NSFOCUS Security Advisory 2000.2

ISBASE Security AdvisorySA2000-02 Topic: IIS ISM.DLL truncation exposes file content Release Date: July 17, 2000 Affected software version: =========================== Microsoft Internet Information Server 4.0 Microsoft Internet Information Server 5.0 Platform: ========== Windows NT 4.0 and Windo...