CVE-2002-0071

CVE-2002-0071: Buffer overflow in the ism.dll ISAPI extension (HTR) of Microsoft IIS 4.0/5.0 allows DoS or arbitrary code execution via crafted HTR requests with long variable names. The vulnerability affects IIS 4.0, 5.0 (and 5.1 per advisories) and is addressed by Microsoft Security Bulletin MS...

CVE-2002-0364

CVE-2002-0364 describes a heap-based buffer overflow in IIS 4.0/5.0 when processing chunked-encoded HTR requests via the HTR ISAPI extension, allowing an attacker to execute arbitrary code with the privileges of the ISAPI process. The vulnerability stems from chunked encoding handling; impact inc...

CVE-2002-0421

IIS 4.0 allows local users to bypass the "User cannot change password" policy for Windows NT by directly calling .htr password changing programs in the /iisadmpwd directory, including 1 aexp2.htr, 2 aexp2b.htr, 3 aexp3.htr , or 4 aexp4.htr...

CVE-2002-0364

Buffer overflow in the chunked encoding transfer mechanism in IIS 4.0 and 5.0 allows attackers to execute arbitrary code via the processing of HTR request sessions, aka "Heap Overrun in HTR Chunked Encoding Could Enable Web Server Compromise."...

Security Bulletin MS02-028: Heap Overrun in HTR Chunked Encoding Could Enable Web Server Compromise (Q321599)

---------------------------------------------------------------------- Title: Heap Overrun in HTR Chunked Encoding Could Enable Web Server Compromise Q321599 Date: 12 June 2002 Software: Internet Information Server Impact: Run Code of Attacker's Choice Max Risk: Moderate Bulletin: MS02-028...

Microsoft IIS .HTR Filter Multiple Overflows (MS02-028)

The remote server is vulnerable to a buffer overflow in the .HTR filter. An attacker may use this flaw to execute arbitrary code on this host although the exploitation of this flaw is considered difficult. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. Script audit and contributions from...

Microsoft Internet Information Server (IIS) contains remote buffer overflow in chunked encoding data transfer mechanism for HTR

Overview A buffer overflow vulnerability in IIS 4.0 and 5.0 could allow an intruder to execute arbitrary code on an IIS server with the privileges of the HTR ISAPI extension. Description Chunked encoding is a means to transfer variable-sized units of data called chunks from a web client to a web...

CVE-2002-0421

The CVE-2002-0421 entry concerns Microsoft IIS 4.0 on Windows NT where local users can bypass the password policy by directly invoking password-changing programs in the /iisadmpwd directory. The affected components are the .htr programs: aexp2.htr, aexp2b.htr, aexp3.htr, and aexp4.htr. The root c...

CVE-2002-0421

IIS 4.0 allows local users to bypass the "User cannot change password" policy for Windows NT by directly calling .htr password changing programs in the /iisadmpwd directory, including 1 aexp2.htr, 2 aexp2b.htr, 3 aexp3.htr , or 4 aexp4.htr...

SPIKE version released that detects .HTR and ISAPI overflows (see spike.sourceforge.net)

At long last, SPIKE is once again allowed to be public. This is the fuzzer creation kit I wrote that finds the .HTR and ISAPI overflow vulnerabilities discussed here: http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/MS02-018.asp and here:...

Microsoft Internet Information Server (IIS) vulnerable to heap overflow during processing of crafted ".htr" request by "ISM.DLL" ISAPI filter

Overview A buffer overflow in the HTR ISAP extension on IIS servers could permit an intruder to interrupt the normal operation of IIS or possibly execute arbitrary code with the privileges of the HTR extension. Description HTR is a server-side scripting technology for IIS which has largely been...

Microsoft IIS .HTR ISAPI Filter Enabled

The IIS server appears to have the .HTR ISAPI filter mapped. At least one remote vulnerability has been discovered for the .HTR filter. This is detailed in Microsoft Advisory MS02-018, and gives remote SYSTEM level access to the web server. It is recommended that, even if you have patched this...

CVE-2000-0457

ISM.DLL in IIS 4.0 and 5.0 allows remote attackers to read file contents by requesting the file and appending a large number of encoded spaces %20 and terminated with a .htr extension, aka the ".HTR File Fragment Reading" or "File Fragment Reading via .HTR" vulnerability...

CVE-2000-0457

Summary: CVE-2000-0457 affects Microsoft IIS 4.0/5.0 via ISM.DLL, enabling remote disclosure of file contents by requesting a file and appending spaces and ".HTR" (the File Fragment Reading vulnerability). Affected component: ISM.DLL in IIS 4.0/5.0 handling .HTR requests. Impact: partial confiden...

CVE-2001-0004

This CVE concerns IIS 4.0/5.0 where an attacker can cause the server to disclose file contents by sending a crafted GET request that appends %3F+.htr, causing the target file to be parsed as an .HTR ISAPI extension. Impact: unauthenticated remote disclosure of potentially sensitive files within t...

CVE-2001-0004

IIS 5.0 and 4.0 allows remote attackers to read the source code for executable web server programs by appending "%3F+.htr" to the requested URL, which causes the files to be parsed by the .HTR ISAPI extension, aka a variant of the "File Fragment Reading via .HTR" vulnerability...

Microsoft Internet Information Server (IIS) discloses contents of files via crafted request for .htr file

Overview A vulnerability exists in Microsoft Internet Information Server IIS which could disclose sensitive information contained in CGI-type files. Typically a CGI/script file on a web server should only be executable and not readable by remote users. Sensitive information contained in such a fi...

Дырка в HTR-файлах IIS

С помощью некорректного запроса к HTR-файлу можно подвесить обрарбатывающий его ISAPI фильтр. Кроме того, через HTR ISAPI ISM.DLL можно получить фрагменты некоторых файлов...

Заткнута дырка в IIS

Один из служебных скриптов зацикливается при отсутствии одного из аргументов. Кроме того найден еще один способ прочитать часть файла через .HTR - файлы доавить "+.htr" к имени файла...

CVE-1999-0874

CVE-1999-0874 maps to a buffer overflow in IIS 4.0’s ISAPI processing of HTR/IDC/STM files (ISM.DLL). Public sources show a remote overflow that can cause denial of service and, in several references, the potential for remote code execution on affected Windows NT systems (MS02-018/Microsoft MS99-...