Detections
Analytics
Microsoft IIS ISM.DLL HTR Request Remote Overflow
critical Nessus Plugin ID 10116
Synopsis
The remote web server is affected by a remote buffer overflow vulnerability.Description
The remote IIS web server is affected by a remote buffer overflow vulnerability. A malformed request for an .HTR, .STM, or .IDC file could lead to a denial of service, or possibly remote arbitrary code execution.Solution
Apply the patch from the bulletin referenced above.See Also
https://docs.microsoft.com/en-us/security-updates/SecurityBulletins/1999/ms99-019
Plugin Details
Severity: Critical
ID: 10116
File Name: iis_buffer_overflow.nasl
Version: 1.60
Type: remote
Family: Web Servers
Published: 6/22/1999
Updated: 4/11/2022
Configuration: Enable paranoid mode, Enable thorough checks
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Critical
Score: 9.0
CVSS v2
Risk Factor: Critical
Base Score: 10
Temporal Score: 8.3
Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C
Vulnerability Information
CPE: cpe:/a:microsoft:iis
Required KB Items: Settings/ParanoidReport
Excluded KB Items: www/too_long_url_crash
Exploit Available: true
Exploit Ease: Exploits are available
Vulnerability Publication Date: 6/8/1999
Exploitable With
Metasploit (MS02-018 Microsoft IIS 4.0 .HTR Path Overflow)
Reference Information
CVE: CVE-1999-0874
BID: 307