CVE-2001-0506

published 2001-09-20

CVE-2001-0506: Buffer overflow in ssinc.dll in IIS 5.0 and 4.0 allows local users to gain system privileges via a Server-Side Includes (SSI) directive for a long filename…

Priority P3 33 high 7.2 CVSS 2.0

AV L AC L Au N C C I C A C

EXPLOIT

Buffer overflow in ssinc.dll in IIS 5.0 and 4.0 allows local users to gain system privileges via a Server-Side Includes (SSI) directive for a long filename, which triggers the overflow when the directory name is added, aka the "SSI privilege elevation" vulnerability.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
microsoft	internet_information_server	—	—
microsoft	internet_information_services	—	—

Detection & IOCs extracted from sources · hover to see the quote

filename ssinc.dll↗

filename ssi.shtml↗

path /ssi_overflow/ssi.shtml↗

bytes↗

8B 94 F8 77 10 F3 C7 F3 C7 22 2D 2D 3E 0D 0A 00

• → The exploit generates a malicious .shtml file placed inside a directory whose name is exactly 12 characters long (e.g. 'ssi_overflow'). Detect creation of .shtml files in newly created 12-character-named web root directories on IIS servers. ↗
• → The exploit payload is delivered via an SSI #include file= directive embedded in a .shtml file. Monitor IIS logs for requests to .shtml files containing oversized filenames in SSI directives processed by ssinc.dll. ↗
• → The exploit shellcode begins with the SSI include tag bytes 0x3C 0x21 0x2D 0x2D 0x23 0x69 0x6E 0x63 0x6C 0x75 0x64 0x65 0x20 0x66 0x69 0x6C 0x65 0x3D 0x22 (<!--#include file="). Scan .shtml files on IIS servers for this byte pattern followed by large NOP sleds. ↗

• · Exploitation requires the attacker to already have write access to the IIS web root. This is a local privilege escalation, not a remote unauthenticated exploit. ↗
• · The directory name placed in the web root must be exactly 12 characters long for the overflow to trigger correctly; other lengths may not reliably exploit the vulnerability. ↗
• · The exploit author noted browser compatibility issues; Internet Explorer is required to trigger the vulnerability reliably, as Netscape caused problems. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.