PT-2002-1161 · Microsoft · Internet Information Server

Published 2002-04-22 · Updated 2020-11-23 · CVE-2002-0072

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Internet Information Server (IIS) versions 4.0 through 5.1

Description The issue arises from the w3svc.dll ISAPI filter's failure to handle long URLs properly, leading to a denial of service when the URL parser encounters a null pointer. This results in a crash.

Recommendations For IIS versions 4.0 through 5.1, consider restricting access to long URLs as a temporary workaround until a patch is available. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Related Identifiers

CVE-2002-0072

Affected Products

Internet Information Server

References · 10

• http://cisco.com/warp/public/707/Microsoft-IIS-vulnerabilities-MS02-018.shtml · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2002-0072 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-018 · Vendor Advisory
• http://iss.net/security_center/static/8800.php · Note
• http://kb.cert.org/vuls/id/521059 · Note
• http://securityfocus.com/bid/4479 · Note
• http://marc.info/?l=bugtraq&m=101853851025208&w=2 · Note
• http://cert.org/advisories/CA-2002-09.html · Note
• http://osvdb.org/3326 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-0072 · Note