Buffer overflow in Internet Information Server (IIS) 4.0, 5.0, and 5.1 allows remote attackers to spoof the safety check for HTTP headers and cause a denial of service or execute arbitrary code via HTTP header field values.

The remote version of Windows contains multiple flaws in the Internet Information Service (IIS), such as heap overflow, DoS, and XSS that could allow an attacker to execute arbitrary code on the remote host with SYSTEM privileges.

This IIS Server appears to be vulnerable to one of the cross-site scripting attacks described in MS02-018. The default '404' file returned by IIS uses scripting to output a link to the top level domain part of the url requested. By crafting a particular URL, it is possible to insert arbitrary script into the page for execution.

The presence of this vulnerability also indicates that you are vulnerable to the other issues identified in MS02-018 (various remote buffer overflow and cross-site scripting attacks.)

ID	Name	Product	Family	Type	Severity
10943	MS02-018: Cumulative Patch for Internet Information Services (327696)	Nessus	Windows : Microsoft Bulletins	Local	critical
10936	Microsoft IIS Multiple Vulnerabilities (MS02-018)	Nessus	CGI abuses	Remote	medium

Detections

Analytics

CVE-2002-0150

critical

Tenable Plugins

critical

medium