Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2009-2521

CWE-400 — Uncontrolled Resource Consumption6 documents5 sources
Severity
5.0MEDIUM
EPSS
60.8%
top 1.70%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
1
Microsoft Internet Information Services
Timeline
PublishedSep 4
Latest updateMay 2

Description

Stack consumption vulnerability in the FTP Service in Microsoft Internet Information Services (IIS) 5.0 through 7.0 allows remote authenticated users to cause a denial of service (daemon crash) via a list (ls) -R command containing a wildcard that references a subdirectory, followed by a .. (dot dot), aka "IIS FTP Service DoS Vulnerability."

CVSS vector

AV:N/AC:L/C:N/I:N/A:PExploitability: 10.0 | Impact: 2.9

Affected Packages1 packages

Patches

Patch: docs.microsoft.com ↗Patch: docs.microsoft.com ↗

🔴Vulnerability Details

3
GHSA
GHSA-w8g4-h8cc-352m: Stack consumption vulnerability in the FTP Service in Microsoft Internet Information Services (IIS) 5↗2022-05-02
▶
CVEList
CVE-2009-2521: Stack consumption vulnerability in the FTP Service in Microsoft Internet Information Services (IIS) 5↗2009-09-04
▶
VulnCheck
Microsoft Internet Information Services (IIS) Uncontrolled Resource Consumption↗2009
▶

💥Exploits & PoCs

2
Exploit-DB
Microsoft IIS 7.0 FTP Server - Stack Exhaustion Denial of Service (MS09-053) (Metasploit)↗2011-07-03
▶
Exploit-DB
Microsoft IIS 5.0/6.0 FTP Server - Stack Exhaustion Denial of Service↗2009-09-04
▶
CVE-2009-2521 (MEDIUM CVSS 5) | Stack consumption vulnerability in | cvebase.io