PT-2002-1161 · Microsoft · Internet Information Server

Publicado 2002-04-22 · Atualizado 2020-11-23 · CVE-2002-0072

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Internet Information Server (IIS) versions 4.0 through 5.1

Description The issue arises from the w3svc.dll ISAPI filter's failure to handle long URLs properly, leading to a denial of service when the URL parser encounters a null pointer. This results in a crash.

Recommendations For IIS versions 4.0 through 5.1, consider restricting access to long URLs as a temporary workaround until a patch is available. At the moment, there is no information about a newer version that contains a fix for this issue.

Correção

Identificadores relacionados

CVE-2002-0072

Produtos afetados

Internet Information Server

Referências · 10

• http://cisco.com/warp/public/707/Microsoft-IIS-vulnerabilities-MS02-018.shtml · Aviso do Fabricante
• http://iss.net/security_center/static/8800.php · Nota
• http://kb.cert.org/vuls/id/521059 · Nota
• http://securityfocus.com/bid/4479 · Nota
• http://marc.info/?l=bugtraq&m=101853851025208&w=2 · Nota
• http://cert.org/advisories/CA-2002-09.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2002-0072 · Nota de Segurança
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-018 · Aviso do Fabricante
• http://osvdb.org/3326 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-0072 · Nota