var-200204-0012
Vulnerability from variot
Buffer overflow in the chunked encoding transfer mechanism in Internet Information Server (IIS) 4.0 and 5.0 Active Server Pages allows attackers to cause a denial of service or execute arbitrary code. This condition affects IIS 4.0 and IIS 5.0. Exploitation of this vulnerability may result in a denial of service or allow for a remote attacker to execute arbitrary instructions on the victim host. Microsoft IIS 5.0 is reported to ship with a default script (iisstart.asp) which may be sufficient for a remote attacker to exploit. Other sample scripts may also be exploitable. A number of Cisco products are affected by this vulnerability, although this issue is not present in the Cisco products themselves
Show details on source website{ "@context": { "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#", "affected_products": { "@id": "https://www.variotdbs.pl/ref/affected_products" }, "configurations": { "@id": "https://www.variotdbs.pl/ref/configurations" }, "credits": { "@id": "https://www.variotdbs.pl/ref/credits" }, "cvss": { "@id": "https://www.variotdbs.pl/ref/cvss/" }, "description": { "@id": "https://www.variotdbs.pl/ref/description/" }, "exploit_availability": { "@id": "https://www.variotdbs.pl/ref/exploit_availability/" }, "external_ids": { "@id": "https://www.variotdbs.pl/ref/external_ids/" }, "iot": { "@id": "https://www.variotdbs.pl/ref/iot/" }, "iot_taxonomy": { "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/" }, "patch": { "@id": "https://www.variotdbs.pl/ref/patch/" }, "problemtype_data": { "@id": "https://www.variotdbs.pl/ref/problemtype_data/" }, "references": { "@id": "https://www.variotdbs.pl/ref/references/" }, "sources": { "@id": "https://www.variotdbs.pl/ref/sources/" }, "sources_release_date": { "@id": "https://www.variotdbs.pl/ref/sources_release_date/" }, "sources_update_date": { "@id": "https://www.variotdbs.pl/ref/sources_update_date/" }, "threat_type": { "@id": "https://www.variotdbs.pl/ref/threat_type/" }, "title": { "@id": "https://www.variotdbs.pl/ref/title/" }, "type": { "@id": "https://www.variotdbs.pl/ref/type/" } }, "@id": "https://www.variotdbs.pl/vuln/VAR-200204-0012", "affected_products": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/affected_products#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" }, "@id": "https://www.variotdbs.pl/ref/sources" } }, "data": [ { "model": null, "scope": null, "trust": 1.6, "vendor": "microsoft", "version": null }, { "model": "internet information server", "scope": "eq", "trust": 1.6, "vendor": "microsoft", "version": "4.0" }, { "model": "internet information services", "scope": "eq", "trust": 1.6, "vendor": "microsoft", "version": "5.0" }, { "model": "iis", "scope": "eq", "trust": 1.4, "vendor": "microsoft", "version": "5.0" }, { "model": "iis", "scope": "eq", "trust": 1.4, "vendor": "microsoft", "version": "4.0" }, { "model": "iis", "scope": "eq", "trust": 1.1, "vendor": "microsoft", "version": "5.1" }, { "model": "unity server", "scope": "eq", "trust": 0.6, "vendor": "cisco", "version": "2.4" }, { "model": "unity server", "scope": "eq", "trust": 0.6, "vendor": "cisco", "version": "2.3" }, { "model": "unity server", "scope": "eq", "trust": 0.6, "vendor": "cisco", "version": "2.2" }, { "model": "unity server", "scope": "eq", "trust": 0.6, "vendor": "cisco", "version": "2.1" }, { "model": "unity server", "scope": "eq", "trust": 0.6, "vendor": "cisco", "version": "2.0" }, { "model": "call manager", "scope": "eq", "trust": 0.6, "vendor": "cisco", "version": "3.2" }, { "model": "call manager", "scope": "eq", "trust": 0.6, "vendor": "cisco", "version": "3.1" }, { "model": "call manager", "scope": "eq", "trust": 0.6, "vendor": "cisco", "version": "3.0" }, { "model": "building broadband service manager", "scope": "eq", "trust": 0.6, "vendor": "cisco", "version": "5.1" }, { "model": "building broadband service manager", "scope": "eq", "trust": 0.6, "vendor": "cisco", "version": "5.0" }, { "model": "building broadband service manager", "scope": "eq", "trust": 0.6, "vendor": "cisco", "version": "4.5" }, { "model": "building broadband service manager", "scope": "eq", "trust": 0.6, "vendor": "cisco", "version": "4.4" }, { "model": "building broadband service manager", "scope": "eq", "trust": 0.6, "vendor": "cisco", "version": "4.3" }, { "model": "building broadband service manager", "scope": "eq", "trust": 0.6, "vendor": "cisco", "version": "4.2" }, { "model": "building broadband service manager", "scope": "eq", "trust": 0.6, "vendor": "cisco", "version": "4.0.1" }, { "model": "internet information server", "scope": "eq", "trust": 0.6, "vendor": "microsoft", "version": "5.0" } ], "sources": [ { "db": "CERT/CC", "id": "VU#610291" }, { "db": "CERT/CC", "id": "VU#669779" }, { "db": "BID", "id": "4485" }, { "db": "BID", "id": "4490" }, { "db": "JVNDB", "id": "JVNDB-2002-000082" }, { "db": "CNNVD", "id": "CNNVD-200204-041" }, { "db": "NVD", "id": "CVE-2002-0079" } ] }, "configurations": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/configurations#", "children": { "@container": "@list" }, "cpe_match": { "@container": "@list" }, "data": { "@container": "@list" }, "nodes": { "@container": "@list" } }, "data": [ { "CVE_data_version": "4.0", "nodes": [ { "cpe_match": [ { "cpe22Uri": "cpe:/a:microsoft:iis", "vulnerable": true } ], "operator": "OR" } ] } ], "sources": [ { "db": "JVNDB", "id": "JVNDB-2002-000082" } ] }, "credits": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/credits#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "Riley Hassell\u203b riley@eeye.com", "sources": [ { "db": "CNNVD", "id": "CNNVD-200204-041" } ], "trust": 0.6 }, "cve": "CVE-2002-0079", "cvss": { "@context": { "cvssV2": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#" }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2" }, "cvssV3": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#" }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/" }, "severity": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/cvss/severity#" }, "@id": "https://www.variotdbs.pl/ref/cvss/severity" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" }, "@id": "https://www.variotdbs.pl/ref/sources" } }, "data": [ { "cvssV2": [ { "accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "author": "nvd@nist.gov", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "exploitabilityScore": 10.0, "id": "CVE-2002-0079", "impactScore": 6.4, "integrityImpact": "PARTIAL", "severity": "HIGH", "trust": 1.8, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0" } ], "cvssV3": [], "severity": [ { "author": "nvd@nist.gov", "id": "CVE-2002-0079", "trust": 1.0, "value": "HIGH" }, { "author": "CARNEGIE MELLON", "id": "VU#610291", "trust": 0.8, "value": "62.44" }, { "author": "CARNEGIE MELLON", "id": "VU#669779", "trust": 0.8, "value": "50.02" }, { "author": "NVD", "id": "CVE-2002-0079", "trust": 0.8, "value": "High" }, { "author": "CNNVD", "id": "CNNVD-200204-041", "trust": 0.6, "value": "HIGH" } ] } ], "sources": [ { "db": "CERT/CC", "id": "VU#610291" }, { "db": "CERT/CC", "id": "VU#669779" }, { "db": "JVNDB", "id": "JVNDB-2002-000082" }, { "db": "CNNVD", "id": "CNNVD-200204-041" }, { "db": "NVD", "id": "CVE-2002-0079" } ] }, "description": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/description#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "Buffer overflow in the chunked encoding transfer mechanism in Internet Information Server (IIS) 4.0 and 5.0 Active Server Pages allows attackers to cause a denial of service or execute arbitrary code. \nThis condition affects IIS 4.0 and IIS 5.0. Exploitation of this vulnerability may result in a denial of service or allow for a remote attacker to execute arbitrary instructions on the victim host. \nMicrosoft IIS 5.0 is reported to ship with a default script (iisstart.asp) which may be sufficient for a remote attacker to exploit. Other sample scripts may also be exploitable. \nA number of Cisco products are affected by this vulnerability, although this issue is not present in the Cisco products themselves", "sources": [ { "db": "NVD", "id": "CVE-2002-0079" }, { "db": "CERT/CC", "id": "VU#610291" }, { "db": "CERT/CC", "id": "VU#669779" }, { "db": "JVNDB", "id": "JVNDB-2002-000082" }, { "db": "BID", "id": "4485" }, { "db": "BID", "id": "4490" } ], "trust": 3.6 }, "external_ids": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/external_ids#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "db": "CERT/CC", "id": "VU#610291", "trust": 3.5 }, { "db": "BID", "id": "4485", "trust": 3.0 }, { "db": "NVD", "id": "CVE-2002-0079", "trust": 2.4 }, { "db": "BID", "id": "4490", "trust": 1.1 }, { "db": "CERT/CC", "id": "VU#669779", "trust": 1.1 }, { "db": "JVNDB", "id": "JVNDB-2002-000082", "trust": 0.8 }, { "db": "CERT/CC", "id": "CA-2002-09", "trust": 0.6 }, { "db": "MS", "id": "MS02-018", "trust": 0.6 }, { "db": "BUGTRAQ", "id": "20020410 WINDOWS 2000 AND NT4 IIS .ASP REMOTE BUFFER OVERFLOW", "trust": 0.6 }, { "db": "XF", "id": "8795", "trust": 0.6 }, { "db": "OVAL", "id": "OVAL:ORG.MITRE.OVAL:DEF:16", "trust": 0.6 }, { "db": "OVAL", "id": "OVAL:ORG.MITRE.OVAL:DEF:25", "trust": 0.6 }, { "db": "CISCO", "id": "20020415 MICROSOFT IIS VULNERABILITIES IN CISCO PRODUCTS - MS02-018", "trust": 0.6 }, { "db": "CNNVD", "id": "CNNVD-200204-041", "trust": 0.6 } ], "sources": [ { "db": "CERT/CC", "id": "VU#610291" }, { "db": "CERT/CC", "id": "VU#669779" }, { "db": "BID", "id": "4485" }, { "db": "BID", "id": "4490" }, { "db": "JVNDB", "id": "JVNDB-2002-000082" }, { "db": "CNNVD", "id": "CNNVD-200204-041" }, { "db": "NVD", "id": "CVE-2002-0079" } ] }, "id": "VAR-200204-0012", "iot": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/iot#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": true, "sources": [ { "db": "VARIoT devices database", "id": null } ], "trust": 1.0 }, "last_update_date": "2024-11-22T22:59:28.508000Z", "patch": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/patch#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "title": "MS02-018", "trust": 0.8, "url": "http://www.microsoft.com/technet/security/bulletin/MS02-018.asp" }, { "title": "MS02-018", "trust": 0.8, "url": "http://www.microsoft.com/japan/technet/security/bulletin/MS02-018.mspx" } ], "sources": [ { "db": "JVNDB", "id": "JVNDB-2002-000082" } ] }, "problemtype_data": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "problemtype": "NVD-CWE-Other", "trust": 1.0 } ], "sources": [ { "db": "NVD", "id": "CVE-2002-0079" } ] }, "references": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/references#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "trust": 3.7, "url": "http://www.kb.cert.org/vuls/id/610291" }, { "trust": 3.4, "url": "http://www.securityfocus.com/bid/4485" }, { "trust": 3.4, "url": "http://www.cert.org/advisories/ca-2002-09.html" }, { "trust": 2.6, "url": "http://www.iss.net/security_center/static/8795.php" }, { "trust": 2.6, "url": "http://www.cisco.com/warp/public/707/microsoft-iis-vulnerabilities-ms02-018.shtml" }, { "trust": 2.2, "url": "http://www.microsoft.com/technet/security/bulletin/ms02-018.asp" }, { "trust": 2.0, "url": "http://marc.info/?l=bugtraq\u0026m=101846993304518\u0026w=2" }, { "trust": 2.0, "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-018" }, { "trust": 2.0, "url": "https://oval.cisecurity.org/repository/search/definition/oval%3aorg.mitre.oval%3adef%3a16" }, { "trust": 2.0, "url": "https://oval.cisecurity.org/repository/search/definition/oval%3aorg.mitre.oval%3adef%3a25" }, { "trust": 1.6, "url": "http://www.eeye.com/html/research/advisories/ad20020410.html" }, { "trust": 0.8, "url": "http://www.microsoft.com/technet/security/urlscan.asp" }, { "trust": 0.8, "url": "http://www.microsoft.com/technet/security/tools/locktool.asp" }, { "trust": 0.8, "url": "http://www.securityfocus.com/bid/4490" }, { "trust": 0.8, "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2002-0079" }, { "trust": 0.8, "url": "http://www.jpcert.or.jp/wr/2002/wr021401.txt" }, { "trust": 0.8, "url": "http://jvn.jp/cert/jvnca-2002-09" }, { "trust": 0.8, "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2002-0079" }, { "trust": 0.6, "url": "http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/ms02-018.asp" }, { "trust": 0.6, "url": "http://support.microsoft.com/default.aspx?scid=kb;en-us;q317636" }, { "trust": 0.6, "url": "http://www.microsoft.com/technet/security/advisory/default.mspx" }, { "trust": 0.6, "url": "http://marc.theaimsgroup.com/?l=bugtraq\u0026m=101846993304518\u0026w=2" }, { "trust": 0.6, "url": "http://oval.mitre.org/repository/data/getdef?id=oval:org.mitre.oval:def:25" }, { "trust": 0.6, "url": "http://oval.mitre.org/repository/data/getdef?id=oval:org.mitre.oval:def:16" }, { "trust": 0.3, "url": "http://support.coresecurity.com/impact/exploits/505b3e16f67af18142eee44ea0c41656.html" }, { "trust": 0.3, "url": "http://online.securityfocus.com/bid/4485" }, { "trust": 0.3, "url": "http://www.kb.cert.org/vuls/id/669779" } ], "sources": [ { "db": "CERT/CC", "id": "VU#610291" }, { "db": "CERT/CC", "id": "VU#669779" }, { "db": "BID", "id": "4485" }, { "db": "BID", "id": "4490" }, { "db": "JVNDB", "id": "JVNDB-2002-000082" }, { "db": "CNNVD", "id": "CNNVD-200204-041" }, { "db": "NVD", "id": "CVE-2002-0079" } ] }, "sources": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", "data": { "@container": "@list" } }, "data": [ { "db": "CERT/CC", "id": "VU#610291" }, { "db": "CERT/CC", "id": "VU#669779" }, { "db": "BID", "id": "4485" }, { "db": "BID", "id": "4490" }, { "db": "JVNDB", "id": "JVNDB-2002-000082" }, { "db": "CNNVD", "id": "CNNVD-200204-041" }, { "db": "NVD", "id": "CVE-2002-0079" } ] }, "sources_release_date": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#", "data": { "@container": "@list" } }, "data": [ { "date": "2002-04-10T00:00:00", "db": "CERT/CC", "id": "VU#610291" }, { "date": "2002-04-10T00:00:00", "db": "CERT/CC", "id": "VU#669779" }, { "date": "2002-04-10T00:00:00", "db": "BID", "id": "4485" }, { "date": "2002-04-10T00:00:00", "db": "BID", "id": "4490" }, { "date": "2007-04-01T00:00:00", "db": "JVNDB", "id": "JVNDB-2002-000082" }, { "date": "2002-04-22T00:00:00", "db": "CNNVD", "id": "CNNVD-200204-041" }, { "date": "2002-04-22T04:00:00", "db": "NVD", "id": "CVE-2002-0079" } ] }, "sources_update_date": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#", "data": { "@container": "@list" } }, "data": [ { "date": "2002-06-13T00:00:00", "db": "CERT/CC", "id": "VU#610291" }, { "date": "2002-06-13T00:00:00", "db": "CERT/CC", "id": "VU#669779" }, { "date": "2002-04-10T00:00:00", "db": "BID", "id": "4485" }, { "date": "2002-04-10T00:00:00", "db": "BID", "id": "4490" }, { "date": "2007-04-01T00:00:00", "db": "JVNDB", "id": "JVNDB-2002-000082" }, { "date": "2005-05-02T00:00:00", "db": "CNNVD", "id": "CNNVD-200204-041" }, { "date": "2024-11-20T23:38:15.473000", "db": "NVD", "id": "CVE-2002-0079" } ] }, "threat_type": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/threat_type#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "network", "sources": [ { "db": "BID", "id": "4485" }, { "db": "BID", "id": "4490" } ], "trust": 0.6 }, "title": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/title#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "Microsoft Internet Information Server (IIS) 4.0 and 5.0 buffer overflow in chunked encoding transfer mechanism for ASP", "sources": [ { "db": "CERT/CC", "id": "VU#610291" } ], "trust": 0.8 }, "type": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/type#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "Boundary Condition Error", "sources": [ { "db": "BID", "id": "4485" }, { "db": "BID", "id": "4490" }, { "db": "CNNVD", "id": "CNNVD-200204-041" } ], "trust": 1.2 } }
Loading…
Loading…
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…