CVE-2005-4360
published 2005-12-20CVE-2005-4360: The URL parser in Microsoft Internet Information Services (IIS) 5.1 on Windows XP Professional SP2 allows remote attackers to execute arbitrary code via…
PriorityP349high7.8CVSS 2.0
AVNACLAuNCNICAN
EXPLOIT
EPSS
86.73%
99.7th percentile
The URL parser in Microsoft Internet Information Services (IIS) 5.1 on Windows XP Professional SP2 allows remote attackers to execute arbitrary code via multiple requests to ".dll" followed by arguments such as "~0" through "~9", which causes ntdll.dll to produce a return value that is not correctly handled by IIS, as demonstrated using "/_vti_bin/.dll/*/~0". NOTE: the consequence was originally believed to be only a denial of service (application crash and reboot).
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | internet_information_services | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Detect HTTP requests targeting IIS executable directories (e.g., /_vti_bin/, /scripts/, /cgi-bin/, /msadc/, /iisadmpwd/) with a path containing '.dll/' followed by a wildcard or special character and '/~[0-9]' pattern. ↗
- →Alert on repeated (4+) HTTP POST or GET requests to paths matching '*.dll/*/~[0-9]' on port 80 targeting IIS 5.1; the exploit sends exactly 4 requests to crash inetinfo.exe. ↗
- →Monitor for IIS URL patterns where '.dll' is followed by arguments '~0' through '~9', which triggers the vulnerable ntdll.dll code path. ↗
- →Only IIS directories with Execute Permissions set to 'Scripts & Executables' are exploitable; scope detection to those virtual directories. ↗
- ·The vulnerability is specific to IIS 5.1 on Windows XP Professional SP2; IIS 5.0 and IIS 6.0 are reported as not vulnerable. ↗
- ·The original impact was classified as denial of service (crash of inetinfo.exe and reboot), but was later revised to allow arbitrary code execution. ↗
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
Microsoft IIS - HTTP Request Denial of Service (2)
exploitdb·2005-12-19
CVE-2005-4360 Microsoft IIS - HTTP Request Denial of Service (2)
Microsoft IIS - HTTP Request Denial of Service (2)
---
#!/usr/bin/perl
# _really_ bored kokanin / IIS 5.1 dos thing, Inge says to use a browser at
# http://ingehenriksen.blogspot.com/2005/12/microsoft-iis-remote-dos-dll-url.html
# kokanin not like puny browser!!"#1 I hoped Inge was a leet haxx0r ch1ck, but it's
# apparently a dude, bummer. According to Inge passing a kinda malformed url to
# an executable dir a few times makes inetinfo.exe crap out. Yum, monday. This
# script has insanely elite randomization of the url, it even amazes me.
# Hello ilja, ptp people, others, see you at ccc and stuff.
# sample executable dirs: /_vti_bin/ /_sharepoint/ /scripts/ /cgi-bin/ /msadc/ /iisadmpwd/
# sample malformed url: http://www.example.xom/_vti_bin/.dll/*\~0
# sample run: ./this-crap.pl
# coun
Exploit-DB
Microsoft IIS - HTTP Request Denial of Service (1)
exploitdb·2005-12-19
CVE-2005-4360 Microsoft IIS - HTTP Request Denial of Service (1)
Microsoft IIS - HTTP Request Denial of Service (1)
---
/*****************************************************************
Microsoft IIS 5.1 Remote D.o.S Exploit by Kozan
Application: Microsoft IIS (Internet Information Server)
Vendor: Microsoft - http://www.microsoft.com/
Discovered by: Inge Henriksen
Exploit Coded by: Kozan
Credits to ATmaCA, Inge Henriksen
Web: www.spyinstructors.com
Mail: [email protected]
Vulnerable:
Microsoft® Internet Information Server® V5.1
Not vulnerable:
Microsoft® Internet Information Server® V5.0
Microsoft® Internet Information Server® V6.0
Only folders with Execute Permissions set to 'Scripts & Executables'
are affected, such as the '_vti_bin' directory.
inetinfo.exe will be crashed after exploitation finished successfuly.
Usage: iis51dos.ex
No writeups or analysis indexed.
http://archive.cert.uni-stuttgart.de/bugtraq/2007/07/msg00254.htmlhttp://ingehenriksen.blogspot.com/2005/12/microsoft-iis-remote-dos-dll-url.htmlhttp://secunia.com/advisories/18106http://securityreason.com/securityalert/271http://securitytracker.com/alerts/2005/Dec/1015376.htmlhttp://www.osvdb.org/21805http://www.securityfocus.com/archive/1/419707/100/0/threadedhttp://www.securityfocus.com/bid/15921http://www.us-cert.gov/cas/techalerts/TA07-191A.htmlhttp://www.vupen.com/english/advisories/2005/2963https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-041https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1703http://archive.cert.uni-stuttgart.de/bugtraq/2007/07/msg00254.htmlhttp://ingehenriksen.blogspot.com/2005/12/microsoft-iis-remote-dos-dll-url.htmlhttp://secunia.com/advisories/18106http://securityreason.com/securityalert/271http://securitytracker.com/alerts/2005/Dec/1015376.htmlhttp://www.osvdb.org/21805http://www.securityfocus.com/archive/1/419707/100/0/threadedhttp://www.securityfocus.com/bid/15921http://www.us-cert.gov/cas/techalerts/TA07-191A.htmlhttp://www.vupen.com/english/advisories/2005/2963https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-041https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1703
2005-12-20
Published