CVE-2002-0079
published 2002-04-22CVE-2002-0079: Buffer overflow in the chunked encoding transfer mechanism in Internet Information Server (IIS) 4.0 and 5.0 Active Server Pages allows attackers to cause a…
PriorityP348high7.5CVSS 2.0
AVNACLAuNCPIPAP
EXPLOIT
EPSS
77.96%
99.6th percentile
Buffer overflow in the chunked encoding transfer mechanism in Internet Information Server (IIS) 4.0 and 5.0 Active Server Pages allows attackers to cause a denial of service or execute arbitrary code.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | products_ms02-018 | — | — |
| microsoft | internet_information_server | — | — |
| microsoft | internet_information_services | — | — |
Detection & IOCsextracted from sources · hover to see the quote
commandPOST <path>?<buf> HTTP/1.0
Content-Type: application/x-www-form-urlencoded
Transfer-Encoding: chunked
10
ABCDEFGHIJKLMNOP
4
XXXX
4
YYYY
0
↗
bytes↗
\xeb\x02\xeb\x05\xe8\xf9\xff\xff\xff\x58\x83\xc0\x1d\x8d\xa0\xf0
bytes↗
\xeb\x18\x5f\x57\x5e\x33\xc9\xac\x3a\xc1\x74\x13\x3c\x30\x74\x05
- →Alert on HTTP POST requests targeting /iisstart.asp (or other .asp files) with both 'Transfer-Encoding: chunked' and an abnormally large query string, as the default IIS 5.0 script is explicitly called out as exploitable. ↗
- →Look for chunked HTTP POST bodies containing multiple small fixed-size chunks (e.g., '10', '4', '4', '0') immediately followed by terminator '0\r\n\r\n' — this is the characteristic exploit request structure across all three exploit variants. ↗
- →The exploit overwrites a top-level exception handler (SEH) at 0x77eaf44c and uses a direct jump payload at 0x0045C560 on unpatched IIS 5.0 — these hardcoded addresses can be used as memory forensic indicators on compromised Windows 2000 systems. ↗
- →The exploit shellcode establishes a reverse/back-channel connection — monitor for unexpected outbound connections from the IIS worker process (inetinfo.exe / w3wp.exe) to external hosts, particularly on port 25. ↗
- →Exploit variant 3 brute-forces return addresses in the range 0x00400000–0x00500000 and binds a shell on port 7788 — scan for unexpected listeners on port 7788 post-exploitation. ↗
- ·The hardcoded RET address (0x0045C560) and SEH overwrite address (0x77eaf44c) are specific to unpatched Windows 2000 / IIS 5.0 Chinese or Japanese versions; they will differ across OS versions, service packs, and locales. ↗
- ·Exploit 1 (21368) was tested specifically on Windows 2000 Chinese Version with IIS 5.0 unpatched; the srcdata and jmpaddr constants (0x01e2fb1c, 0x00457494) are version-specific and may not apply to other builds. ↗
- ·Cisco products are affected only because they run on top of vulnerable IIS installations — the vulnerability is in IIS itself, not in the Cisco software, so patching IIS resolves the exposure for Cisco products as well. ↗
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-jj78-89rw-69p6: Buffer overflow in the chunked encoding transfer mechanism in Internet Information Server (IIS) 4
ghsa_unreviewed·2022-04-30
CVE-2002-0079 [HIGH] GHSA-jj78-89rw-69p6: Buffer overflow in the chunked encoding transfer mechanism in Internet Information Server (IIS) 4
Buffer overflow in the chunked encoding transfer mechanism in Internet Information Server (IIS) 4.0 and 5.0 Active Server Pages allows attackers to cause a denial of service or execute arbitrary code.
Cisco
Microsoft IIS Vulnerabilities in Cisco Products - MS02-018
vendor_cisco·2002-04-15
CVE-2002-0071 Microsoft IIS Vulnerabilities in Cisco Products - MS02-018
Microsoft IIS Vulnerabilities in Cisco Products - MS02-018
This advisory describes a vulnerability that affects Cisco products and
applications that are installed on Microsoft operating systems incorporating
the use of the Internet Information Server (IIS), and is based on the
vulnerability of IIS, not due to a defect of the Cisco product or application.
A number of vulnerabilities were discovered that enables an attacker to
execute arbitrary code or perform a denial of service against the server. These
vulnerabilities were discovered and publicly announced by Microsoft in their
Microsoft Security Bulletin MS02-018.
This advisory is available at
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20020415-ms02-018.
Cisco
Microsoft IIS Vulnerabilities in Cisco Products - MS02-018
vendor_cisco
CVE-2002-0079 Microsoft IIS Vulnerabilities in Cisco Products - MS02-018
CVE-2002-0079: Microsoft IIS Vulnerabilities in Cisco Products - MS02-018
This advisory describes a vulnerability that affects Cisco products and applications that are installed on Microsoft operating systems incorporating the use of the Internet Information Server (IIS), and is based on the vulnerability of IIS, not due to a defect of the Cisco product or application. A number of vulnerabilities were discovered that enables an attacker to execute arbitrary code or perform a denial of service against the server. These vulnerabilities were discovered and publicly announced by Microsoft in their Microsoft Security Bulletin MS02-018. This advisory is available at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20020415-ms02-018 .
No detection rules found.
Exploit-DB
Microsoft IIS 4.0/5.0 - Chunked Encoding Transfer Heap Overflow (4)
exploitdb·2002-04-24
CVE-2002-0079 Microsoft IIS 4.0/5.0 - Chunked Encoding Transfer Heap Overflow (4)
Microsoft IIS 4.0/5.0 - Chunked Encoding Transfer Heap Overflow (4)
---
/*
source: https://www.securityfocus.com/bid/4485/info
A heap overflow condition in the 'chunked encoding transfer mechanism' related to Active Server Pages has been reported for Microsoft IIS (Internet Information Services).
This condition affects IIS 4.0 and IIS 5.0. Exploitation of this vulnerability may result in a denial of service or allow for a remote attacker to execute arbitrary instructions on the victim host.
Microsoft IIS 5.0 is reported to ship with a default script (iisstart.asp) which may be sufficient for a remote attacker to exploit. Other sample scripts may also be exploitable.
A number of Cisco products are affected by this vulnerability, although this issue is not present in the Cisco products
Exploit-DB
Microsoft IIS 4.0/5.0 - Chunked Encoding Transfer Heap Overflow (2)
exploitdb·2002-04-14
CVE-2002-0079 Microsoft IIS 4.0/5.0 - Chunked Encoding Transfer Heap Overflow (2)
Microsoft IIS 4.0/5.0 - Chunked Encoding Transfer Heap Overflow (2)
---
// source: https://www.securityfocus.com/bid/4485/info
A heap overflow condition in the 'chunked encoding transfer mechanism' related to Active Server Pages has been reported for Microsoft IIS (Internet Information Services).
This condition affects IIS 4.0 and IIS 5.0. Exploitation of this vulnerability may result in a denial of service or allow for a remote attacker to execute arbitrary instructions on the victim host.
Microsoft IIS 5.0 is reported to ship with a default script (iisstart.asp) which may be sufficient for a remote attacker to exploit. Other sample scripts may also be exploitable.
A number of Cisco products are affected by this vulnerability, although this issue is not present in the Cisco products
Exploit-DB
Microsoft IIS 4.0/5.0 - Chunked Encoding Transfer Heap Overflow (1)
exploitdb·2002-04-10
CVE-2002-0079 Microsoft IIS 4.0/5.0 - Chunked Encoding Transfer Heap Overflow (1)
Microsoft IIS 4.0/5.0 - Chunked Encoding Transfer Heap Overflow (1)
---
// source: https://www.securityfocus.com/bid/4485/info
A heap overflow condition in the 'chunked encoding transfer mechanism' related to Active Server Pages has been reported for Microsoft IIS (Internet Information Services).
This condition affects IIS 4.0 and IIS 5.0. Exploitation of this vulnerability may result in a denial of service or allow for a remote attacker to execute arbitrary instructions on the victim host.
Microsoft IIS 5.0 is reported to ship with a default script (iisstart.asp) which may be sufficient for a remote attacker to exploit. Other sample scripts may also be exploitable.
A number of Cisco products are affected by this vulnerability, although this issue is not present in the Cisco products
Exploit-DB
Microsoft IIS 4.0/5.0 - Chunked Encoding Transfer Heap Overflow (3)
exploitdb·2002-04-10
CVE-2002-0079 Microsoft IIS 4.0/5.0 - Chunked Encoding Transfer Heap Overflow (3)
Microsoft IIS 4.0/5.0 - Chunked Encoding Transfer Heap Overflow (3)
---
// source: https://www.securityfocus.com/bid/4485/info
A heap overflow condition in the 'chunked encoding transfer mechanism' related to Active Server Pages has been reported for Microsoft IIS (Internet Information Services).
This condition affects IIS 4.0 and IIS 5.0. Exploitation of this vulnerability may result in a denial of service or allow for a remote attacker to execute arbitrary instructions on the victim host.
Microsoft IIS 5.0 is reported to ship with a default script (iisstart.asp) which may be sufficient for a remote attacker to exploit. Other sample scripts may also be exploitable.
A number of Cisco products are affected by this vulnerability, although this issue is not present in the Cisco products
No writeups or analysis indexed.
http://marc.info/?l=bugtraq&m=101846993304518&w=2http://www.cert.org/advisories/CA-2002-09.htmlhttp://www.cisco.com/warp/public/707/Microsoft-IIS-vulnerabilities-MS02-018.shtmlhttp://www.iss.net/security_center/static/8795.phphttp://www.kb.cert.org/vuls/id/610291http://www.securityfocus.com/bid/4485https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-018https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A25http://marc.info/?l=bugtraq&m=101846993304518&w=2http://www.cert.org/advisories/CA-2002-09.htmlhttp://www.cisco.com/warp/public/707/Microsoft-IIS-vulnerabilities-MS02-018.shtmlhttp://www.iss.net/security_center/static/8795.phphttp://www.kb.cert.org/vuls/id/610291http://www.securityfocus.com/bid/4485https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-018https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A25
2002-04-22
Published