CVE-2001-0334 — Incorrect Calculation of Buffer Size in Microsoft Internet Information Server

CWE-131 — Incorrect Calculation of Buffer SizeCWE-49 — Path Equivalence: 'filename/' (Trailing Slash)4 documents4 sources
Severity
7.5HIGHNVD
EPSS
30.6%
top 3.28%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Microsoft Internet Information Server
Timeline
PublishedJun 27
Latest updateApr 30

Description

FTP service in IIS 5.0 and earlier allows remote attackers to cause a denial of service via a wildcard sequence that generates a long string when it is expanded.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages1 packages

Patches

Patch: docs.microsoft.com ↗Patch: docs.microsoft.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-xr97-cg4f-4xr7: FTP service in IIS 5↗2022-04-30
▶
CVEList
CVE-2001-0334: FTP service in IIS 5↗2001-09-18
▶

📐Framework References

1
CWE
Path Equivalence: 'filename/' (Trailing Slash)
▶
CVE-2001-0334 — Incorrect Calculation of Buffer Size | cvebase