CVE-2002-1142
published 2002-11-29CVE-2002-1142: Heap-based buffer overflow in the Remote Data Services (RDS) component of Microsoft Data Access Components (MDAC) 2.1 through 2.6, and Internet Explorer 5.01…
PriorityP352high7.5CVSS 2.0
AVNACLAuNCPIPAP
EXPLOIT
EPSS
76.00%
99.5th percentile
Heap-based buffer overflow in the Remote Data Services (RDS) component of Microsoft Data Access Components (MDAC) 2.1 through 2.6, and Internet Explorer 5.01 through 6.0, allows remote attackers to execute code via a malformed HTTP request to the Data Stub.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | data_access_components | — | — |
| microsoft | data_access_components | — | — |
| microsoft | data_access_components | — | — |
| microsoft | ie | — | — |
| microsoft | internet_explorer | — | — |
| microsoft | internet_explorer | — | — |
| microsoft | internet_explorer | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Detect exploit attempts by monitoring HTTP POST requests to /msadc/msadcs.dll/AdvancedDataFactory.Query with an overly long Content-Type header (heap overflow trigger). ↗
- →Fingerprint vulnerable/exposed endpoints by checking for HTTP 200 responses containing 'Content-Type: application/x-varg' from GET requests to /msadc/msadcs.dll. ↗
- →The exploit payload uses a 136-byte alphanumeric buffer with a short JMP at offset 24 (2 bytes) and a stack adjustment of -3500; anomalous Content-Type headers of this length in RDS requests are a strong indicator. ↗
- →The exploit targets ws2help.dll at address 0x75023783 (jmp eax) on Windows 2000 Pro English SP0; presence of this return address in network traffic or memory is a strong exploit indicator. ↗
- →The exploit is effective even when RDS is configured to deny remote connections via handsafe.reg; do not rely solely on RDS lockdown as a detection bypass indicator. ↗
- ·Payload bad characters must be excluded from detection signatures; the exploit explicitly avoids these bytes in shellcode. ↗
- ·The EXITFUNC is set to 'seh' to prevent IIS from crashing post-exploitation, meaning a successful exploit may not result in an immediate service crash — absence of crash is not evidence of safety. ↗
- ·The return address (0x75023783 in ws2help.dll) is specific to Windows 2000 Pro English SP0; detections relying on this value will not apply to other OS versions or service packs. ↗
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
Microsoft IIS - MDAC 'msadcs.dll' RDS DataStub Content-Type Overflow (MS02-065) (Metasploit)
exploitdb·2012-06-08
CVE-2002-1142 Microsoft IIS - MDAC 'msadcs.dll' RDS DataStub Content-Type Overflow (MS02-065) (Metasploit)
Microsoft IIS - MDAC 'msadcs.dll' RDS DataStub Content-Type Overflow (MS02-065) (Metasploit)
---
##
# $Id$
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
# http://metasploit.com/
##
require 'msf/core'
class Metasploit3 'Microsoft IIS MDAC msadcs.dll RDS DataStub Content-Type Overflow',
'Description' => %q{
This module can be used to execute arbitrary code on IIS servers
that expose the /msadc/msadcs.dll Microsoft Data Access Components
(MDAC) Remote Data Service (RDS) DataFactory service. The service is
exploitable even when RDS is configured to deny remote connections
(handsafe.reg). The service is vulnerable to a heap ove
Metasploit
MS02-065 Microsoft IIS MDAC msadcs.dll RDS DataStub Content-Type Overflow
metasploit
MS02-065 Microsoft IIS MDAC msadcs.dll RDS DataStub Content-Type Overflow
MS02-065 Microsoft IIS MDAC msadcs.dll RDS DataStub Content-Type Overflow
This module can be used to execute arbitrary code on IIS servers that expose the /msadc/msadcs.dll Microsoft Data Access Components (MDAC) Remote Data Service (RDS) DataFactory service. The service is exploitable even when RDS is configured to deny remote connections (handsafe.reg). The service is vulnerable to a heap overflow where the RDS DataStub 'Content-Type' string is overly long. Microsoft Data Access Components (MDAC) 2.1 through 2.6 are known to be vulnerable.
No writeups or analysis indexed.
http://archives.neohapsis.com/archives/vulnwatch/2002-q4/0082.htmlhttp://www.cert.org/advisories/CA-2002-33.htmlhttp://www.foundstone.com/knowledge/randd-advisories-display.html?id=337http://www.kb.cert.org/vuls/id/542081http://www.securityfocus.com/bid/6214https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-065https://exchange.xforce.ibmcloud.com/vulnerabilities/10659https://exchange.xforce.ibmcloud.com/vulnerabilities/10669https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2730https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A294https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A3573http://archives.neohapsis.com/archives/vulnwatch/2002-q4/0082.htmlhttp://www.cert.org/advisories/CA-2002-33.htmlhttp://www.foundstone.com/knowledge/randd-advisories-display.html?id=337http://www.kb.cert.org/vuls/id/542081http://www.securityfocus.com/bid/6214https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-065https://exchange.xforce.ibmcloud.com/vulnerabilities/10659https://exchange.xforce.ibmcloud.com/vulnerabilities/10669https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2730https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A294https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A3573
2002-11-29
Published