CVE-2000-0408

published 2000-05-11

CVE-2000-0408: IIS 4.05 and 5.0 allow remote attackers to cause a denial of service via a long, complex URL that appears to contain a large number of file extensions, aka the…

Priority P4 22 medium 5 CVSS 2.0

AV N AC L Au N C N I N A P

EXPLOIT

IIS 4.05 and 5.0 allow remote attackers to cause a denial of service via a long, complex URL that appears to contain a large number of file extensions, aka the "Malformed Extension Data in URL" vulnerability.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
microsoft	internet_information_server	—	—
microsoft	internet_information_services	—	—

Detection & IOCs extracted from sources · hover to see the quote

url https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19907-1.exe↗

url https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19907.zip↗

• → Look for abnormally long URLs containing a large number of file extension sequences (e.g., repeated dot-separated segments) in IIS HTTP access logs, which is the hallmark of this DoS attack. ↗
• → Monitor IIS 4.0/5.0 host CPU usage for sudden spikes to 100% correlated with inbound HTTP requests containing malformed extension data, as the vulnerability causes CPU exhaustion until the URL is fully processed. ↗

• · Affected versions are IIS 4.0 and 5.0 only; the DoS condition requires restarting the IIS application or waiting for the malformed URL to finish processing before normal service resumes. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.