CVE-2010-1899
published 2010-09-15CVE-2010-1899: Stack consumption vulnerability in the ASP implementation in Microsoft Internet Information Services (IIS) 5.1, 6.0, 7.0, and 7.5 allows remote attackers to…
PriorityP336medium4.3CVSS 2.0
AVNACMAuNCNINAP
EXPLOIT
EPSS
57.23%
99.1th percentile
Stack consumption vulnerability in the ASP implementation in Microsoft Internet Information Services (IIS) 5.1, 6.0, 7.0, and 7.5 allows remote attackers to cause a denial of service (daemon outage) via a crafted request, related to asp.dll, aka "IIS Repeated Parameter Request Denial of Service Vulnerability."
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | internet_information_server | — | — |
| microsoft | internet_information_services | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Detect HTTP POST requests to ASP endpoints containing an abnormally large number of repeated URL-encoded parameters (>40,000 key=value pairs), which is the attack trigger for stack exhaustion in asp.dll. ↗
- →Monitor for repeated IIS worker process (w3wp.exe) crashes in rapid succession (five or more consecutive crashes), which causes the default application pool to be disabled — a strong indicator of active exploitation. ↗
- →The attack requires an ASP script that reads POST form values to be hosted on IIS; focus monitoring on ASP endpoints that process Request.Form or equivalent POST argument reads. ↗
- →The exploit can be sent by unauthenticated remote attackers; no session or authentication token is required, so network-level detection should not filter on authenticated sessions. ↗
- ·Exploitation requires that Active Server Pages (ASP) are actively hosted on IIS AND that at least one ASP script reads a POST form value; IIS servers not hosting ASP or not reading POST parameters are not vulnerable to this specific attack vector. ↗
- ·A specific setting in metabase.xml must be present/modified for the stack exhaustion to be triggered; default out-of-box configurations may behave differently. ↗
- ·Only IIS 6.0 on Windows Server 2003 (SP0, SP1, SP2) was confirmed successfully exploited in testing; IIS 5.1, 7.0, and 7.5 are listed as affected by the CVE but were not validated in the published PoC. ↗
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
Microsoft IIS 6.0 - ASP Stack Overflow Stack Exhaustion (Denial of Service) (MS10-065)
exploitdb·2010-10-01
CVE-2010-1899 Microsoft IIS 6.0 - ASP Stack Overflow Stack Exhaustion (Denial of Service) (MS10-065)
Microsoft IIS 6.0 - ASP Stack Overflow Stack Exhaustion (Denial of Service) (MS10-065)
---
Affected Vendors
Microsoft
Affected Products
Only Microsoft IIS 6.0 was tested successfully
On a Windows Server 2003 SP2 System
The System was NOT updated to the latest patches during testing.
Since tests “in the wild” have shown the attack to be real this advisory was released.
Vulnerability Details
The vulnerability allows remote unauthenticated attackers to force the IIS server to become
unresponsive until the IIS service is restarted manually by the administrator.
Required is that Active Server Pages are hosted by the IIS and that an ASP script reads out a
Post Form value. When the following ASP script is hosted by IIS the attacker can run the
attack:
This small script reads out a POST re
Metasploit
Microsoft IIS 6.0 ASP Stack Exhaustion Denial of Service
metasploit
Microsoft IIS 6.0 ASP Stack Exhaustion Denial of Service
Microsoft IIS 6.0 ASP Stack Exhaustion Denial of Service
The vulnerability allows remote unauthenticated attackers to force the IIS server to become unresponsive until the IIS service is restarted manually by the administrator. Required is that Active Server Pages are hosted by the IIS and that an ASP script reads out a Post Form value.
No writeups or analysis indexed.
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-065https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7127https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-065https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7127
2010-09-15
Published