CVE-2006-0026

published 2006-07-11

CVE-2006-0026: Buffer overflow in Microsoft Internet Information Services (IIS) 5.0, 5.1, and 6.0 allows local and possibly remote attackers to execute arbitrary code via…

Priority P3 57 medium 6.5 CVSS 2.0

AV N AC L Au S C P I P A P

EXPLOIT

Buffer overflow in Microsoft Internet Information Services (IIS) 5.0, 5.1, and 6.0 allows local and possibly remote attackers to execute arbitrary code via crafted Active Server Pages (ASP).

Affected

2 ranges

Vendor	Product	Version range	Fixed in
microsoft	internet_information_server	—	—
microsoft	internet_information_services	—	—

Detection & IOCs extracted from sources · hover to see the quote

filename exploit2000.asp↗

• → The exploit generates a malicious ASP file named 'exploit2000.asp' that must be uploaded to an IIS web directory and then requested via browser to trigger shellcode execution; monitor IIS web directories for newly created or uploaded .asp files with anomalous binary content. ↗
• → The overflow is triggered by crafting an ASP file with an include header whose filename length exceeds 0x104 (260) bytes (length=0x10c > 0x104), followed by 0x135 bytes of padding before the overwrite gadgets; anomalously long ASP #include directives should be flagged. ↗

• · The hardcoded JMP-EBX return address (0x77E64A66) is specific to Windows 2000 Server SP4 + IIS 5.0; it will differ on other OS/patch levels and the exploit author notes IIS 6.0 exploitation requires additional luck due to SEH protections. ↗
• · The shellcode must be free of Unicode null terminators (0x0000) due to ASP/Unicode string handling constraints, which constrains the usable shellcode character set and may affect detection signatures relying on null bytes. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.