CVE-2002-0150

Buffer overflow in Internet Information Server IIS 4.0, 5.0, and 5.1 allows remote attackers to spoof the safety check for HTTP headers and cause a denial of service or execute arbitrary code via HTTP header field values...

CVE-2002-0074

Cross-site scripting vulnerability in Help File search facility for Internet Information Server IIS 4.0, 5.0 and 5.1 allows remote attackers to embed scripts into another user's session...

CVE-2002-0079

The CVE-2002-0079 issue is a heap/buffer overflow in the ASP ISAPI filter of Microsoft IIS (4.0/5.0) triggered by chunked-encoded POST data in ASP pages. Public writeups (SAINT) describe remote exploitation causing crashes in dllhost.exe or arbitrary code execution on IIS 5.0, with a patch refere...

CVE-2002-0075

Cross-site scripting vulnerability for Internet Information Server IIS 4.0, 5.0 and 5.1 allows remote attackers to execute arbitrary script as other web users via the error message used in a URL redirect ""302 Object Moved" message...

CVE-2002-0072

The w3svc.dll ISAPI filter in Front Page Server Extensions and ASP.NET for Internet Information Server IIS 4.0, 5.0, and 5.1 does not properly handle the error condition when a long URL is provided, which allows remote attackers to cause a denial of service crash when the URL parser accesses a nu...

CVE-2002-0079

Buffer overflow in the chunked encoding transfer mechanism in Internet Information Server IIS 4.0 and 5.0 Active Server Pages allows attackers to cause a denial of service or execute arbitrary code...

CVE-2002-0072

CVE-2002-0072 describes a denial-of-service in Microsoft IIS 4.0/5.0/5.1 caused by the w3svc.dll FP2002/ISAPI filter when handling an overly long URL. The error handling rewrites a URL to a null value and then dereferences it, crashing Inetinfo.exe. Affected components: FP2002 Front Page Server E...

CVE-2002-0147

Buffer overflow in the ASP data transfer mechanism in Internet Information Server IIS 4.0, 5.0, and 5.1 allows remote attackers to cause a denial of service or execute code, aka "Microsoft-discovered variant of Chunked Encoding buffer overrun."...

CVE-2002-0073

The FTP service in Internet Information Server IIS 4.0, 5.0 and 5.1 allows attackers who have established an FTP session to cause a denial of service via a specially crafted status request containing glob characters...

CVE-2002-0148

Cross-site scripting vulnerability in Internet Information Server IIS 4.0, 5.0 and 5.1 allows remote attackers to execute arbitrary script as other users via an HTTP error page...

CVE-2002-1718

Microsoft Internet Information Server IIS 5.1 may allow remote attackers to view the contents of a Frontpage Server Extension FPSE file, as claimed using an HTTP request for colegal.htm that contains .. dot dot sequences...

CVE-2002-1717

Microsoft Internet Information Server IIS 5.1 allows remote attackers to view path information via a GET request to 1 /vtipvt/access.cnf, 2 /vtipvt/botinfs.cnf, 3 /vtipvt/bots.cnf, or 4 /vtipvt/linkinfo.cnf...

CVE-2002-1180

A typographical error in the script source access permissions for Internet Information Server IIS 5.0 does not properly exclude .COM files, which allows attackers with only write permissions to upload malicious .COM files, aka "Script Source Access Vulnerability."...

CVE-2002-0869

Unknown vulnerability in the hosting process dllhost.exe for Microsoft Internet Information Server IIS 4.0 through 5.1 allows remote attackers to gain privileges by executing an out of process application that acquires LocalSystem privileges, aka "Out of Process Privilege Elevation."...

CVE-2002-1181

Multiple cross-site scripting XSS vulnerabilities in the administrative web pages for Microsoft Internet Information Server IIS 4.0 through 5.1 allow remote attackers to execute HTML script as other users through 1 a certain ASP file in the IISHELP virtual directory, or 2 possibly other unknown...

CVE-2002-0869

Unknown vulnerability in the hosting process dllhost.exe for Microsoft Internet Information Server IIS 4.0 through 5.1 allows remote attackers to gain privileges by executing an out of process application that acquires LocalSystem privileges, aka "Out of Process Privilege Elevation."...

CVE-2002-1181

Multiple cross-site scripting XSS vulnerabilities in the administrative web pages for Microsoft Internet Information Server IIS 4.0 through 5.1 allow remote attackers to execute HTML script as other users through 1 a certain ASP file in the IISHELP virtual directory, or 2 possibly other unknown...

DLA-25-06-2002.txt

Digit-Labs Security Advisory http://www.digit-labs.org/ Advisory Name: IIS Administration Web Site redirect exploits Release Date: 25.June-2002 Application: Microsoft Internet Information Server 5.0 Platform: Windows 2000 Professional Severity: Low/Medium Authors: GoLLuM.no...

Security Bulletin MS02-028: Heap Overrun in HTR Chunked Encoding Could Enable Web Server Compromise (Q321599)

---------------------------------------------------------------------- Title: Heap Overrun in HTR Chunked Encoding Could Enable Web Server Compromise Q321599 Date: 12 June 2002 Software: Internet Information Server Impact: Run Code of Attacker's Choice Max Risk: Moderate Bulletin: MS02-028...

servletexec-4.1.txt

Westpoint Security Advisory Title: Multiple vulnerabilities in NewAtlanta ServletExec ISAPI 4.1 Risk Rating: High Software: ServletExec 4.1 ISAPI / IIS 4 & 5 Platforms: Win2k / WinNT 4 Vendor URL: www.newatlanta.com Author: Matt Moore Date: 22 May 2002 Advisory ID: wp-02-0006.txt Overview:...