CVE-2001-1243
published 2001-07-04CVE-2001-1243: Scripting.FileSystemObject in asp.dll for Microsoft IIS 4.0 and 5.0 allows local or remote attackers to cause a denial of service (crash) via (1) creating an…
PriorityP427medium5CVSS 2.0
AVNACLAuNCNINAP
EXPLOIT
EPSS
63.19%
99.1th percentile
Scripting.FileSystemObject in asp.dll for Microsoft IIS 4.0 and 5.0 allows local or remote attackers to cause a denial of service (crash) via (1) creating an ASP program that uses Scripting.FileSystemObject to open a file with an MS-DOS device name, or (2) remotely injecting the device name into ASP programs that internally use Scripting.FileSystemObject.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | internet_information_server | — | — |
| microsoft | internet_information_services | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Look for HTTP requests to ASP scripts where query string parameters contain MS-DOS device names (e.g., com1, com2, lpt1, aux, con, nul, prn) — this is the remote injection vector for the DoS. ↗
- →Monitor IIS 4.0/5.0 for ASP files invoking Scripting.FileSystemObject with MS-DOS device name arguments, which triggers the crash condition. ↗
- →Alert on new .asp file creation by local users on IIS servers, particularly files referencing Scripting.FileSystemObject combined with device name strings. ↗
- ·The remote exploitation vector requires that the target ASP application internally uses Scripting.FileSystemObject and accepts user-supplied input that is passed to it — not all IIS deployments are equally exposed. ↗
- ·Successful exploitation crashes the server and requires a manual service restart to restore functionality; there is no self-recovery. ↗
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
Microsoft IIS 4.0/5.0 - Device File Local Denial of Service
exploitdb·2001-07-04
CVE-2001-1243 Microsoft IIS 4.0/5.0 - Device File Local Denial of Service
Microsoft IIS 4.0/5.0 - Device File Local Denial of Service
---
source: https://www.securityfocus.com/bid/2973/info
Microsoft IIS is prone to denial of service attacks by local users. This issue is exploitable if the local attacker can create an .asp file which makes calls to various devices names. The local attacker must of course possess the privileges required to create such files.
The end result of exploiting this vulnerability is that the server will crash and a denial of services will occur. The affected services must be restarted to regain normal functionality.
Exploit-DB
Microsoft IIS 4.0/5.0 - Device File Remote Denial of Service
exploitdb·2001-07-04
CVE-2001-1243 Microsoft IIS 4.0/5.0 - Device File Remote Denial of Service
Microsoft IIS 4.0/5.0 - Device File Remote Denial of Service
---
source: https://www.securityfocus.com/bid/2977/info
Microsoft IIS is prone to denial of service attacks by remote attackers. This can occur if the remote attack crafts a URL which tries to pass a script parameter that is a device name.
The end result of exploiting this vulnerability is that the server will crash and a denial of services will occur. The affected services must be restarted to regain normal functionality.
http://host.int/scripts/script.asp?script=com1
No writeups or analysis indexed.
2001-07-04
Published