Vulnerabilities > CVE-2002-0147 - Unspecified vulnerability in Microsoft products
Attack vector
NETWORK Attack complexity
LOW Privileges required
NONE Confidentiality impact
PARTIAL Integrity impact
PARTIAL Availability impact
PARTIAL Summary
Buffer overflow in the ASP data transfer mechanism in Internet Information Server (IIS) 4.0, 5.0, and 5.1 allows remote attackers to cause a denial of service or execute code, aka "Microsoft-discovered variant of Chunked Encoding buffer overrun."
Vulnerable Configurations
| Part | Description | Count |
|---|---|---|
| Application | 2 |
Nessus
NASL family Web Servers NASL id IIS_ASP_OVERFLOW.NASL description There last seen 2020-06-01 modified 2020-06-02 plugin id 10935 published 2002-04-10 reporter This script is Copyright (C) 2002-2018 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/10935 title Microsoft IIS ASP ISAPI Filter Multiple Overflows NASL family Windows : Microsoft Bulletins NASL id SMB_NT_MS02-018.NASL description The remote version of Windows contains multiple flaws in the Internet Information Service (IIS), such as heap overflow, DoS, and XSS that could allow an attacker to execute arbitrary code on the remote host with SYSTEM privileges. last seen 2020-06-01 modified 2020-06-02 plugin id 10943 published 2002-04-23 reporter This script is Copyright (C) 2002-2018 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/10943 title MS02-018: Cumulative Patch for Internet Information Services (327696)
Oval
accepted 2010-12-20T04:00:42.264-05:00 class vulnerability contributors name Andrew Buttner organization The MITRE Corporation name Glenn Strickland organization Secure Elements, Inc. name Shane Shaffer organization G2, Inc. name Josh Turpin organization Symantec Corporation name Sudhir Gandhe organization Telos name Shane Shaffer organization G2, Inc.
description Buffer overflow in the ASP data transfer mechanism in Internet Information Server (IIS) 4.0, 5.0, and 5.1 allows remote attackers to cause a denial of service or execute code, aka "Microsoft-discovered variant of Chunked Encoding buffer overrun." family windows id oval:org.mitre.oval:def:22 status deprecated submitted 2004-01-14T12:00:00.000-04:00 title DEPRECATED: Windows 2000 Variant of Chunked Encoding Buffer Overrun version 33 accepted 2007-05-23T15:05:51.497-04:00 class vulnerability contributors name Tiffany Bergeron organization The MITRE Corporation name Glenn Strickland organization Secure Elements, Inc. name Josh Turpin organization Symantec Corporation
description Buffer overflow in the ASP data transfer mechanism in Internet Information Server (IIS) 4.0, 5.0, and 5.1 allows remote attackers to cause a denial of service or execute code, aka "Microsoft-discovered variant of Chunked Encoding buffer overrun." family windows id oval:org.mitre.oval:def:72 status deprecated submitted 2004-01-14T12:00:00.000-04:00 title DEPRECATED: Windows NT Variant of Chunked Encoding Buffer Overrun version 29
References
- http://www.cert.org/advisories/CA-2002-09.html
- http://www.cisco.com/warp/public/707/Microsoft-IIS-vulnerabilities-MS02-018.shtml
- http://www.iss.net/security_center/static/8796.php
- http://www.kb.cert.org/vuls/id/669779
- http://www.osvdb.org/3301
- http://www.securityfocus.com/bid/4490
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-018
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A22
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A72