CVE-2003-0227: The logging capability for unicast and multicast transmissions in the ISAPI extension for Microsoft Windows Media Services in Microsoft Windows NT 4.0 and…

PriorityP432medium5CVSS 2.0

AVNACLAuNCNINAP

EXPLOIT

EPSS

38.78%

98.4th percentile

The logging capability for unicast and multicast transmissions in the ISAPI extension for Microsoft Windows Media Services in Microsoft Windows NT 4.0 and 2000, nsiislog.dll, allows remote attackers to cause a denial of service in Internet Information Server (IIS) and execute arbitrary code via a certain network request.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
microsoft	windows_nt	—	—

Detection & IOCsextracted from sources · hover to see the quote

filenamensiislog.dll↗

path/scripts/nsiislog.dll↗

commandPOST /scripts/nsiislog.dll HTTP/1.1↗

bytes↗

\x90\xeb\x03\x5d\xeb\x05\xe8\xf8\xff\xff\xff\x83\xc5\x15\x90\x90

→Detect exploit attempts by monitoring for HTTP POST requests to /scripts/nsiislog.dll with an abnormally large Content-Length header (e.g., 65536 bytes). ↗
→The exploit overwrites memory at a fixed offset (0x2704) with a short JMP sequence (0x04eb06eb) and a hardcoded return address (0x40F0135c); look for these DWORD values in POST body payloads to /scripts/nsiislog.dll. ↗

·The hardcoded return address (0x40F0135c) and buffer offset (0x2704) in the exploit are specific to a particular build/patch level of the vulnerable Windows Media Services ISAPI DLL; these values may differ across targets. ↗
·The exploit targets the ISAPI extension nsiislog.dll present in Microsoft Windows NT 4.0 and Windows 2000 with Windows Media Services; the vulnerable component is only present when Windows Media Services is installed alongside IIS. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.