IIS 5.0 uses relative paths to find system files that will run in-process, which allows local users to gain privileges via a Trojan horse file, aka the "System file listing privilege elevation" vulnerability.

There's a buffer overflow in the remote web server through the ISAPI filter.
 It is possible to overflow the remote web server and execute commands as user SYSTEM.

Additionally, other vulnerabilities exist in the remote web server since it has not been patched.

When IIS receives a user request to run a script, it renders the request in a decoded canonical form, and then performs security checks on the decoded request.  A vulnerability results because a second, superfluous decoding pass is performed after the initial security checks are completed.  Thus, a specially crafted request could allow an attacker to execute arbitrary commands on the IIS Server.

ID	Name	Product	Family	Type	Severity
10685	Microsoft IIS ISAPI Filter Multiple Vulnerabilities (MS01-044)	Nessus	Web Servers	Remote	critical
10671	MS01-026 / MS01-044: Microsoft IIS Remote Command Execution (uncredentialed check)	Nessus	Web Servers	Remote	high

Detections

Analytics

CVE-2001-0507

high

Tenable Plugins

critical

high