PT-2001-2375 · Microsoft · Iis

Published 2001-07-04 · Updated 2018-10-30 · CVE-2001-1243

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Microsoft IIS versions 4.0 through 5.0

Description The issue allows local or remote attackers to cause a denial of service (crash) via creating an ASP program that uses Scripting.FileSystemObject to open a file with an MS-DOS device name, or remotely injecting the device name into ASP programs that internally use Scripting.FileSystemObject.

Recommendations For Microsoft IIS versions 4.0 through 5.0, consider disabling the use of Scripting.FileSystemObject in ASP programs until a fix is available. Restrict access to ASP programs that internally use Scripting.FileSystemObject to minimize the risk of exploitation. Avoid using MS-DOS device names in file operations with Scripting.FileSystemObject until the issue is resolved.

Exploit

Fix

Related Identifiers

CVE-2001-1243

Affected Products

Iis

References · 7

• 🔥 https://exploit-db.com/exploits/20989 · Exploit
• 🔥 https://exploit-db.com/exploits/20991 · Exploit
• 🔥 http://securityfocus.com/bid/2973 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2001-1243 · Security Note
• http://iss.net/security_center/static/6800.php · Vendor Advisory
• http://securityfocus.com/archive/1/194919 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2001-1243 · Note