CVE-2006-1364
published 2006-03-23CVE-2006-1364: Microsoft w3wp (aka w3wp.exe) does not properly handle when the AspCompat directive is not used when referencing COM components in ASP.NET, which allows remote…
PriorityP347high7.5CVSS 3.0
AVNACLPRNUINSUCNINAH
EXPLOIT
EPSS
58.74%
99.0th percentile
Microsoft w3wp (aka w3wp.exe) does not properly handle when the AspCompat directive is not used when referencing COM components in ASP.NET, which allows remote attackers to cause a denial of service (resource consumption or crash) by repeatedly requesting each of several documents that refer to COM components, or are restricted documents located under the ASP.NET application path.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | asp.net | <= 1.1 | — |
| microsoft | asp.net | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Detect repeated HTTP GET requests using backslash path separators (e.g., /aspnet-app\...) targeting .aspx, web.config, and .logs files — a hallmark of this exploit's path traversal and COM-reference DoS pattern. ↗
- →Alert on HTTP requests carrying the specific exploit User-Agent 'Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)' combined with Keep-Alive connections to port 80 in rapid succession. ↗
- →Monitor for the presence of the hardcoded .ASPXAUTH cookie token value in HTTP requests, which the exploit injects to increase effectiveness against authenticated ASP.NET applications. ↗
- →Detect resource exhaustion or crash of w3wp.exe triggered by repeated requests to ASP.NET pages referencing COM components without the AspCompat directive. ↗
- →Flag HTTP GET requests targeting restricted paths under the ASP.NET application path (e.g., web.config, log files) using mixed forward/backslash separators indicative of path traversal attempts. ↗
- ·The exploit's target paths (e.g., /aspnet-app\com-ref-link1.aspx) are template placeholders; operators must substitute their actual ASP.NET application paths and COM-referencing page names when writing detection signatures. ↗
- ·The hardcoded ASP.NET_SessionId and .ASPXAUTH cookie values in the exploit are static samples; real-world attackers may substitute valid session tokens, so detection should not rely solely on these exact values. ↗
CVSS provenance
nvdv3.07.5HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv2.07.8HIGHAV:N/AC:L/Au:N/C:N/I:N/A:C
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
Oracle 9i/10g - 'extproc' Local/Remote Command Execution
exploitdb·2006-12-19·CVSS 8.5
CVE-2004-1364 [HIGH] Oracle 9i/10g - 'extproc' Local/Remote Command Execution
Oracle 9i/10g - 'extproc' Local/Remote Command Execution
---
--
-- $Id: raptor_oraextproc.sql,v 1.1 2006/12/19 14:21:00 raptor Exp $
--
-- raptor_oraextproc.sql - command exec via oracle extproc
-- Copyright (c) 2006 Marco Ivaldi
--
-- Directory traversal vulnerability in extproc in Oracle 9i and 10g
-- allows remote attackers to access arbitrary libraries outside of the
-- $ORACLE_HOME\bin directory (CVE-2004-1364).
--
-- This PL/SQL code exploits the Oracle extproc directory traversal bug
-- to remotely execute arbitrary OS commands with the privileges of the DBMS
-- user (the CREATE [ANY] LIBRARY privilege is needed).
--
-- See also:
-- http://www.0xdeadbeef.info/exploits/raptor_oraexec.sql
-- http://www.0xdeadbeef.info/exploits/raptor_orafile.sql
--
-- Vulnerable platforms:
-- Oracle
Exploit-DB
ASP.NET w3wp - COM Components Remote Crash
exploitdb·2006-03-22
CVE-2006-1364 ASP.NET w3wp - COM Components Remote Crash
ASP.NET w3wp - COM Components Remote Crash
---
// w3wp-dos.c
//
#include "stdafx.h"
#pragma comment (lib,"ws2_32")
#include
#include
#include
#include
#include
#include
#include
char * pszUnauthLinks(DWORD);
#define portno 80
int main(int argc, CHAR* argv[])
{
char szWorkBuff[100];
DWORD dwCount = 0, dwCounter;
int iCnt = 0, iCount = 0;
SOCKET conn_socket;
WSADATA wsaData;
struct sockaddr_in sin;
struct hostent *phostent;
char *pszTargetHost = new char[MAX_PATH];
UINT uAddr;
if (argc \n\n");
exit(0);
}
int iRetval;
if((iRetval = WSAStartup(0x202,&wsaData)) != 0) {
printf( "WSAStartup failed with error %d\n",iRetval);
WSACleanup(); exit(1); }
// Make a check on the length of the parameter provided
if (strlen(argv[1]) > MAX_PATH) {
printf( "Too long parameter ....\n"); exit(1);
Exploit-DB
Oracle 9i - Multiple Vulnerabilities
exploitdb·2004-08-04·CVSS 8.5
CVE-2004-1364 [HIGH] Oracle 9i - Multiple Vulnerabilities
Oracle 9i - Multiple Vulnerabilities
---
source: https://www.securityfocus.com/bid/10871/info
Reportedly, multiple unspecified Oracle products contain multiple unspecified vulnerabilities.
The reported vulnerabilities include SQL-injection issues, buffer-overflow issues, and others.
There have also been reports that issues covered in this BID and resolved in the referenced Oracle patch include trigger-abuse issues, character-set-conversion bugs, and denial-of-service vulnerabilities. More information is pending.
Note that a number of unsupported versions of affected products may also potentially be vulnerable.
--
-- $Id: raptor_oraextproc.sql,v 1.1 2006/12/19 14:21:00 raptor Exp $
--
-- raptor_oraextproc.sql - command exec via oracle extproc
-- Copyright (c) 2006 Marco Ivaldi
--
--
No writeups or analysis indexed.
http://hackingspirits.com/vuln-rnd/w3wp-remote-dos.ziphttp://lists.grok.org.uk/pipermail/full-disclosure/2006-March/044291.htmlhttp://lists.grok.org.uk/pipermail/full-disclosure/2006-March/044292.htmlhttp://securitytracker.com/id?1015825http://www.securiteam.com/windowsntfocus/5KP0O0KI0Y.htmlhttp://www.securityfocus.com/archive/1/428622/100/0/threadedhttp://www.securityfocus.com/bid/17188https://exchange.xforce.ibmcloud.com/vulnerabilities/25392https://www.exploit-db.com/exploits/1601http://hackingspirits.com/vuln-rnd/w3wp-remote-dos.ziphttp://lists.grok.org.uk/pipermail/full-disclosure/2006-March/044291.htmlhttp://lists.grok.org.uk/pipermail/full-disclosure/2006-March/044292.htmlhttp://securitytracker.com/id?1015825http://www.securiteam.com/windowsntfocus/5KP0O0KI0Y.htmlhttp://www.securityfocus.com/archive/1/428622/100/0/threadedhttp://www.securityfocus.com/bid/17188https://exchange.xforce.ibmcloud.com/vulnerabilities/25392https://www.exploit-db.com/exploits/1601
2006-03-23
Published