Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-1999-0874 — Improper Restriction of Operations within the Bounds of a Memory Buffer in Microsoft Internet Information Server

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer8 documents4 sources
Severity
10.0CRITICALNVD
EPSS
84.5%
top 0.67%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
2
Microsoft Internet Information ServerMicrosoft Windows NT
Timeline
PublishedJun 16
Latest updateApr 30

Description

Buffer overflow in IIS 4.0 allows remote attackers to cause a denial of service via a malformed request for files with .HTR, .IDC, or .STM extensions.

CVSS vector

AV:N/AC:L/C:C/I:C/A:CExploitability: 10.0 | Impact: 10.0

Affected Packages2 packages

🔴Vulnerability Details

2
GHSA
GHSA-5c7g-wprj-cxg3: Buffer overflow in IIS 4↗2022-04-30
▶
CVEList
CVE-1999-0874: Buffer overflow in IIS 4↗2000-06-02
▶

💥Exploits & PoCs

5
Exploit-DB
Microsoft IIS 4.0 - '.htr' Path Overflow (MS02-018) (Metasploit)↗2010-04-30
▶
Exploit-DB
Microsoft IIS 4.0 - Remote Buffer Overflow (3)↗1999-06-15
▶
Exploit-DB
Microsoft IIS 4.0 - Remote Buffer Overflow (2)↗1999-06-15
▶
Exploit-DB
Microsoft IIS 4.0 - Remote Buffer Overflow (1)↗1999-06-15
▶
Exploit-DB
Microsoft IIS 4.0 - Remote Buffer Overflow (4)↗1999-06-15
▶
CVE-1999-0874 — Microsoft vulnerability | cvebase