cbcvebase.
CVE-2002-0371
published 2002-07-03

CVE-2002-0371: Buffer overflow in gopher client for Microsoft Internet Explorer 5.1 through 6.0, Proxy Server 2.0, or ISA Server 2000 allows remote attackers to execute…

PriorityP335high7.5CVSS 2.0
AVNACLAuNCPIPAP
EXPLOIT
EPSS
54.44%
98.9th percentile
Buffer overflow in gopher client for Microsoft Internet Explorer 5.1 through 6.0, Proxy Server 2.0, or ISA Server 2000 allows remote attackers to execute arbitrary code via a gopher:// URL that redirects the user to a real or simulated gopher server that sends a long response.

Affected

5 ranges
VendorProductVersion rangeFixed in
microsoftinternet_explorer——
microsoftinternet_explorer——
microsoftinternet_explorer——
microsoftisa_server——
microsoftproxy_server——

Detection & IOCsextracted from sources · hover to see the quote

commandgopher://↗
bytes↗
\x68\x5e\x56\xc3\x90\x54\x59\xff\xd1\x58\x33\xc9\xb1\x1c\x90\x90\x90\x90\x03\xf1\x56\x5f
  • →Monitor for inbound gopher:// URL scheme usage in browser or proxy traffic; a long server response to a gopher request is the trigger for the buffer overflow ↗
  • →The vulnerability is in the component that parses gopher replies; detect anomalously large gopher protocol responses at the network perimeter or proxy layer ↗
  • →Post-exploitation shellcode opens a listening port shell on TCP 8008; alert on unexpected listening services on port 8008 on Windows hosts ↗
  • →Shellcode byte sequence begins with \x68\x5e\x56\xc3\x90\x54\x59\xff\xd1\x58\x33\xc9\xb1\x1c; scan memory or network captures for this signature in gopher response payloads ↗
  • ·Exploit shellcode addresses (LoadLibrary, GetProcAddress) are OS/SP-specific and differ between W2K SP2 Korean, W2K Korean, and WMe Korean builds; return addresses must be adjusted per target installation ↗
  • ·Exploit was only tested on W2K Korean SP2 and WMe Korean; behaviour on other locales or service pack levels is unconfirmed ↗
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.