Microsoft Internet Information Server vulnerabilities

CVE-1999-1538 [LOW] CVE-1999-1538: When IIS 2 or 3 is upgraded to IIS 4, ism.dll is inadvertently left in /scripts/iisadmin, which does When IIS 2 or 3 is upgraded to IIS 4, ism.dll is inadvertently left in /scripts/iisadmin, which does not restrict access to the local machine and allows an unauthorized user to gain access to sensitive server information, including the Administrator's password.

CVE-2000-0408 [MEDIUM] CVE-2000-0408: IIS 4.05 and 5.0 allow remote attackers to cause a denial of service via a long, complex URL that ap IIS 4.05 and 5.0 allow remote attackers to cause a denial of service via a long, complex URL that appears to contain a large number of file extensions, aka the "Malformed Extension Data in URL" vulnerability.

CVE-2002-0150 [HIGH] CVE-2002-0150: Buffer overflow in Internet Information Server (IIS) 4.0, 5.0, and 5.1 allows remote attackers to sp Buffer overflow in Internet Information Server (IIS) 4.0, 5.0, and 5.1 allows remote attackers to spoof the safety check for HTTP headers and cause a denial of service or execute arbitrary code via HTTP header field values.

CVE-1999-0867 [MEDIUM] CWE-20 CVE-1999-0867: Denial of service in IIS 4.0 via a flood of HTTP requests with malformed headers. Denial of service in IIS 4.0 via a flood of HTTP requests with malformed headers.

CVE-2000-0413 [MEDIUM] CVE-2000-0413: The shtml.exe program in the FrontPage extensions package of IIS 4.0 and 5.0 allows remote attackers The shtml.exe program in the FrontPage extensions package of IIS 4.0 and 5.0 allows remote attackers to determine the physical path of HTML, HTM, ASP, and SHTML files by requesting a file that does not exist, which generates an error message that reveals the path.

CVE-2001-0336 [MEDIUM] CVE-2001-0336: The Microsoft MS00-060 patch for IIS 5.0 and earlier introduces an error which allows attackers to c The Microsoft MS00-060 patch for IIS 5.0 and earlier introduces an error which allows attackers to cause a denial of service via a malformed request.

CVE-2002-0364 [HIGH] CVE-2002-0364: Buffer overflow in the chunked encoding transfer mechanism in IIS 4.0 and 5.0 allows attackers to ex Buffer overflow in the chunked encoding transfer mechanism in IIS 4.0 and 5.0 allows attackers to execute arbitrary code via the processing of HTR request sessions, aka "Heap Overrun in HTR Chunked Encoding Could Enable Web Server Compromise."

CVE-2002-0869 [HIGH] CVE-2002-0869: Unknown vulnerability in the hosting process (dllhost.exe) for Microsoft Internet Information Server Unknown vulnerability in the hosting process (dllhost.exe) for Microsoft Internet Information Server (IIS) 4.0 through 5.1 allows remote attackers to gain privileges by executing an out of process application that acquires LocalSystem privileges, aka "Out of Process Privilege Elevation."

CVE-1999-0449 [HIGH] CVE-1999-0449: The ExAir sample site in IIS 4 allows remote attackers to cause a denial of service (CPU consumption The ExAir sample site in IIS 4 allows remote attackers to cause a denial of service (CPU consumption) via a direct request to the (1) advsearch.asp, (2) query.asp, or (3) search.asp scripts.

CVE-1999-1591 [HIGH] CVE-1999-1591: Microsoft Internet Information Services (IIS) server 4.0 SP4, without certain hotfixes released for Microsoft Internet Information Services (IIS) server 4.0 SP4, without certain hotfixes released for SP4, does not require authentication credentials under certain conditions, which allows remote attackers to bypass authentication requirements, as demonstrated by connecting via Microsoft Visual InterDev 6.0.

CVE-1999-0349 [HIGH] CWE-119 CVE-1999-0349: A buffer overflow in the FTP list (ls) command in IIS allows remote attackers to conduct a denial of A buffer overflow in the FTP list (ls) command in IIS allows remote attackers to conduct a denial of service and, in some cases, execute arbitrary commands.

CVE-2004-0205 [HIGH] CVE-2004-0205: Buffer overflow in Microsoft Internet Information Server (IIS) 4.0 allows local users to execute arb Buffer overflow in Microsoft Internet Information Server (IIS) 4.0 allows local users to execute arbitrary code via the redirect function.

CVE-2000-0970 [HIGH] CVE-2000-0970: IIS 4.0 and 5.0 .ASP pages send the same Session ID cookie for secure and insecure web sessions, whi IIS 4.0 and 5.0 .ASP pages send the same Session ID cookie for secure and insecure web sessions, which could allow remote attackers to hijack the secure web session of the user if that user moves to an insecure session, aka the "Session ID Cookie Marking" vulnerability.

CVE-1999-0777 [HIGH] CWE-264 CVE-1999-0777: IIS FTP servers may allow a remote attacker to read or delete files on the server, even if they have IIS FTP servers may allow a remote attacker to read or delete files on the server, even if they have "No Access" permissions.

CVE-2002-0071 [HIGH] CVE-2002-0071: Buffer overflow in the ism.dll ISAPI extension that implements HTR scripting in Internet Information Buffer overflow in the ism.dll ISAPI extension that implements HTR scripting in Internet Information Server (IIS) 4.0 and 5.0 allows attackers to cause a denial of service or execute arbitrary code via HTR requests with long variable names.

CVE-1999-0407 [CRITICAL] CVE-1999-0407: By default, IIS 4.0 has a virtual directory /IISADMPWD which contains files that can be used as prox By default, IIS 4.0 has a virtual directory /IISADMPWD which contains files that can be used as proxies for brute force password attacks, or to identify valid users on the system.

CVE-2008-0074 [HIGH] CWE-264 CVE-2008-0074: Unspecified vulnerability in Microsoft Internet Information Services (IIS) 5.0 through 7.0 allows lo Unspecified vulnerability in Microsoft Internet Information Services (IIS) 5.0 through 7.0 allows local users to gain privileges via unknown vectors related to file change notifications in the TPRoot, NNTPFile\Root, or WWWRoot folders.

CVE-2002-0072 [MEDIUM] CVE-2002-0072: The w3svc.dll ISAPI filter in Front Page Server Extensions and ASP.NET for Internet Information Serv The w3svc.dll ISAPI filter in Front Page Server Extensions and ASP.NET for Internet Information Server (IIS) 4.0, 5.0, and 5.1 does not properly handle the error condition when a long URL is provided, which allows remote attackers to cause a denial of service (crash) when the URL parser accesses a null pointer.

CVE-1999-0739 [MEDIUM] CVE-1999-0739: The codebrws.asp sample file in IIS and Site Server allows remote attackers to read arbitrary files. The codebrws.asp sample file in IIS and Site Server allows remote attackers to read arbitrary files.

CVE-1999-0738 [MEDIUM] CVE-1999-0738: The code.asp sample file in IIS and Site Server allows remote attackers to read arbitrary files. The code.asp sample file in IIS and Site Server allows remote attackers to read arbitrary files.