CVE-2002-0071
published 2002-04-22CVE-2002-0071: Buffer overflow in the ism.dll ISAPI extension that implements HTR scripting in Internet Information Server (IIS) 4.0 and 5.0 allows attackers to cause a…
PriorityP432high7.5CVSS 2.0
AVNACLAuNCPIPAP
EPSS
26.05%
97.7th percentile
Buffer overflow in the ism.dll ISAPI extension that implements HTR scripting in Internet Information Server (IIS) 4.0 and 5.0 allows attackers to cause a denial of service or execute arbitrary code via HTR requests with long variable names.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | products_ms02-018 | — | — |
| microsoft | internet_information_server | — | — |
| microsoft | internet_information_services | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Monitor for HTTP requests targeting HTR scripting endpoints with abnormally long variable names, which indicate exploitation attempts against the ism.dll ISAPI buffer overflow. ↗
- →Identify presence and execution of the ism.dll ISAPI extension on IIS 4.0 and 5.0 servers as an attack surface indicator. ↗
- ·Vulnerability is in IIS itself (ism.dll ISAPI extension), not in the Cisco product or application installed on top of it. Cisco products are affected only because they are installed on Microsoft operating systems incorporating IIS. ↗
- ·Affected IIS versions are 4.0 and 5.0 only; scope detection rules accordingly. ↗
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-6xx5-gpjw-m8wc: Buffer overflow in the ism
ghsa_unreviewed·2022-04-30
CVE-2002-0071 [HIGH] GHSA-6xx5-gpjw-m8wc: Buffer overflow in the ism
Buffer overflow in the ism.dll ISAPI extension that implements HTR scripting in Internet Information Server (IIS) 4.0 and 5.0 allows attackers to cause a denial of service or execute arbitrary code via HTR requests with long variable names.
Cisco
Microsoft IIS Vulnerabilities in Cisco Products - MS02-018
vendor_cisco·2002-04-15
CVE-2002-0071 Microsoft IIS Vulnerabilities in Cisco Products - MS02-018
Microsoft IIS Vulnerabilities in Cisco Products - MS02-018
This advisory describes a vulnerability that affects Cisco products and
applications that are installed on Microsoft operating systems incorporating
the use of the Internet Information Server (IIS), and is based on the
vulnerability of IIS, not due to a defect of the Cisco product or application.
A number of vulnerabilities were discovered that enables an attacker to
execute arbitrary code or perform a denial of service against the server. These
vulnerabilities were discovered and publicly announced by Microsoft in their
Microsoft Security Bulletin MS02-018.
This advisory is available at
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20020415-ms02-018.
Cisco
Microsoft IIS Vulnerabilities in Cisco Products - MS02-018
vendor_cisco
CVE-2002-0071 Microsoft IIS Vulnerabilities in Cisco Products - MS02-018
CVE-2002-0071: Microsoft IIS Vulnerabilities in Cisco Products - MS02-018
This advisory describes a vulnerability that affects Cisco products and applications that are installed on Microsoft operating systems incorporating the use of the Internet Information Server (IIS), and is based on the vulnerability of IIS, not due to a defect of the Cisco product or application. A number of vulnerabilities were discovered that enables an attacker to execute arbitrary code or perform a denial of service against the server. These vulnerabilities were discovered and publicly announced by Microsoft in their Microsoft Security Bulletin MS02-018. This advisory is available at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20020415-ms02-018 .
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://marc.info/?l=bugtraq&m=101854087828265&w=2http://www.atstake.com/research/advisories/2002/a041002-1.txthttp://www.cert.org/advisories/CA-2002-09.htmlhttp://www.cisco.com/warp/public/707/Microsoft-IIS-vulnerabilities-MS02-018.shtmlhttp://www.iss.net/security_center/static/8799.phphttp://www.kb.cert.org/vuls/id/363715http://www.osvdb.org/3325http://www.securityfocus.com/bid/4474https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-018https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A130https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A45http://marc.info/?l=bugtraq&m=101854087828265&w=2http://www.atstake.com/research/advisories/2002/a041002-1.txthttp://www.cert.org/advisories/CA-2002-09.htmlhttp://www.cisco.com/warp/public/707/Microsoft-IIS-vulnerabilities-MS02-018.shtmlhttp://www.iss.net/security_center/static/8799.phphttp://www.kb.cert.org/vuls/id/363715http://www.osvdb.org/3325http://www.securityfocus.com/bid/4474https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-018https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A130https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A45
2002-04-22
Published