Microsoft Internet Information Server vulnerabilities

CVE-2002-0150 [HIGH] CVE-2002-0150: Buffer overflow in Internet Information Server (IIS) 4.0, 5.0, and 5.1 allows remote attackers to sp Buffer overflow in Internet Information Server (IIS) 4.0, 5.0, and 5.1 allows remote attackers to spoof the safety check for HTTP headers and cause a denial of service or execute arbitrary code via HTTP header field values.

CVE-2000-1147 [MEDIUM] CVE-2000-1147: Buffer overflow in IIS ISAPI .ASP parsing mechanism allows attackers to execute arbitrary commands v Buffer overflow in IIS ISAPI .ASP parsing mechanism allows attackers to execute arbitrary commands via a long string to the "LANGUAGE" argument in a script tag.

CVE-2002-0364 [HIGH] CVE-2002-0364: Buffer overflow in the chunked encoding transfer mechanism in IIS 4.0 and 5.0 allows attackers to ex Buffer overflow in the chunked encoding transfer mechanism in IIS 4.0 and 5.0 allows attackers to execute arbitrary code via the processing of HTR request sessions, aka "Heap Overrun in HTR Chunked Encoding Could Enable Web Server Compromise."

CVE-1999-1538 [LOW] CVE-1999-1538: When IIS 2 or 3 is upgraded to IIS 4, ism.dll is inadvertently left in /scripts/iisadmin, which does When IIS 2 or 3 is upgraded to IIS 4, ism.dll is inadvertently left in /scripts/iisadmin, which does not restrict access to the local machine and allows an unauthorized user to gain access to sensitive server information, including the Administrator's password.

CVE-2000-0413 [MEDIUM] CVE-2000-0413: The shtml.exe program in the FrontPage extensions package of IIS 4.0 and 5.0 allows remote attackers The shtml.exe program in the FrontPage extensions package of IIS 4.0 and 5.0 allows remote attackers to determine the physical path of HTML, HTM, ASP, and SHTML files by requesting a file that does not exist, which generates an error message that reveals the path.

CVE-1999-0867 [MEDIUM] CWE-20 CVE-1999-0867: Denial of service in IIS 4.0 via a flood of HTTP requests with malformed headers. Denial of service in IIS 4.0 via a flood of HTTP requests with malformed headers.

CVE-2001-0336 [MEDIUM] CVE-2001-0336: The Microsoft MS00-060 patch for IIS 5.0 and earlier introduces an error which allows attackers to c The Microsoft MS00-060 patch for IIS 5.0 and earlier introduces an error which allows attackers to cause a denial of service via a malformed request.

CVE-2002-0869 [HIGH] CVE-2002-0869: Unknown vulnerability in the hosting process (dllhost.exe) for Microsoft Internet Information Server Unknown vulnerability in the hosting process (dllhost.exe) for Microsoft Internet Information Server (IIS) 4.0 through 5.1 allows remote attackers to gain privileges by executing an out of process application that acquires LocalSystem privileges, aka "Out of Process Privilege Elevation."

CVE-1999-0449 [HIGH] CVE-1999-0449: The ExAir sample site in IIS 4 allows remote attackers to cause a denial of service (CPU consumption The ExAir sample site in IIS 4 allows remote attackers to cause a denial of service (CPU consumption) via a direct request to the (1) advsearch.asp, (2) query.asp, or (3) search.asp scripts.

CVE-2002-0071 [HIGH] CVE-2002-0071: Buffer overflow in the ism.dll ISAPI extension that implements HTR scripting in Internet Information Buffer overflow in the ism.dll ISAPI extension that implements HTR scripting in Internet Information Server (IIS) 4.0 and 5.0 allows attackers to cause a denial of service or execute arbitrary code via HTR requests with long variable names.

CVE-1999-1591 [HIGH] CVE-1999-1591: Microsoft Internet Information Services (IIS) server 4.0 SP4, without certain hotfixes released for Microsoft Internet Information Services (IIS) server 4.0 SP4, without certain hotfixes released for SP4, does not require authentication credentials under certain conditions, which allows remote attackers to bypass authentication requirements, as demonstrated by connecting via Microsoft Visual InterDev 6.0.

CVE-2002-0073 [MEDIUM] CVE-2002-0073: The FTP service in Internet Information Server (IIS) 4.0, 5.0 and 5.1 allows attackers who have esta The FTP service in Internet Information Server (IIS) 4.0, 5.0 and 5.1 allows attackers who have established an FTP session to cause a denial of service via a specially crafted status request containing glob characters.

CVE-2000-0970 [HIGH] CVE-2000-0970: IIS 4.0 and 5.0 .ASP pages send the same Session ID cookie for secure and insecure web sessions, whi IIS 4.0 and 5.0 .ASP pages send the same Session ID cookie for secure and insecure web sessions, which could allow remote attackers to hijack the secure web session of the user if that user moves to an insecure session, aka the "Session ID Cookie Marking" vulnerability.

CVE-1999-0349 [HIGH] CWE-119 CVE-1999-0349: A buffer overflow in the FTP list (ls) command in IIS allows remote attackers to conduct a denial of A buffer overflow in the FTP list (ls) command in IIS allows remote attackers to conduct a denial of service and, in some cases, execute arbitrary commands.

CVE-2004-0205 [HIGH] CVE-2004-0205: Buffer overflow in Microsoft Internet Information Server (IIS) 4.0 allows local users to execute arb Buffer overflow in Microsoft Internet Information Server (IIS) 4.0 allows local users to execute arbitrary code via the redirect function.

CVE-2002-0072 [MEDIUM] CVE-2002-0072: The w3svc.dll ISAPI filter in Front Page Server Extensions and ASP.NET for Internet Information Serv The w3svc.dll ISAPI filter in Front Page Server Extensions and ASP.NET for Internet Information Server (IIS) 4.0, 5.0, and 5.1 does not properly handle the error condition when a long URL is provided, which allows remote attackers to cause a denial of service (crash) when the URL parser accesses a null pointer.

CVE-2002-0074 [HIGH] CVE-2002-0074: Cross-site scripting vulnerability in Help File search facility for Internet Information Server (IIS Cross-site scripting vulnerability in Help File search facility for Internet Information Server (IIS) 4.0, 5.0 and 5.1 allows remote attackers to embed scripts into another user's session.

CVE-2002-0075 [HIGH] CVE-2002-0075: Cross-site scripting vulnerability for Internet Information Server (IIS) 4.0, 5.0 and 5.1 allows rem Cross-site scripting vulnerability for Internet Information Server (IIS) 4.0, 5.0 and 5.1 allows remote attackers to execute arbitrary script as other web users via the error message used in a URL redirect (""302 Object Moved") message.

CVE-1999-0777 [HIGH] CWE-264 CVE-1999-0777: IIS FTP servers may allow a remote attacker to read or delete files on the server, even if they have IIS FTP servers may allow a remote attacker to read or delete files on the server, even if they have "No Access" permissions.

CVE-1999-0407 [CRITICAL] CVE-1999-0407: By default, IIS 4.0 has a virtual directory /IISADMPWD which contains files that can be used as prox By default, IIS 4.0 has a virtual directory /IISADMPWD which contains files that can be used as proxies for brute force password attacks, or to identify valid users on the system.