PT-2001-2375 · Microsoft · Iis

Publicado 2001-07-04 · Atualizado 2018-10-30 · CVE-2001-1243

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Microsoft IIS versions 4.0 through 5.0

Description The issue allows local or remote attackers to cause a denial of service (crash) via creating an ASP program that uses Scripting.FileSystemObject to open a file with an MS-DOS device name, or remotely injecting the device name into ASP programs that internally use Scripting.FileSystemObject.

Recommendations For Microsoft IIS versions 4.0 through 5.0, consider disabling the use of Scripting.FileSystemObject in ASP programs until a fix is available. Restrict access to ASP programs that internally use Scripting.FileSystemObject to minimize the risk of exploitation. Avoid using MS-DOS device names in file operations with Scripting.FileSystemObject until the issue is resolved.

Exploit

Correção

Identificadores relacionados

CVE-2001-1243

Produtos afetados

Iis

Referências · 7

• 🔥 https://exploit-db.com/exploits/20989 · Exploit
• 🔥 https://exploit-db.com/exploits/20991 · Exploit
• 🔥 http://securityfocus.com/bid/2973 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2001-1243 · Nota de Segurança
• http://securityfocus.com/archive/1/194919 · Nota
• http://iss.net/security_center/static/6800.php · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2001-1243 · Nota