MS00-086: Webserver file request parsing (277873)

Critical Nessus Plugin ID 10632


Arbitrary code can be executed on the remote host.


The hotfix for the 'Webserver file request parsing' problem has not been applied.

This vulnerability can allow an attacker to execute arbitrary commands through the remote IIS server.


Microsoft has released a set of patches for IIS 4.0 and 5.0.

See Also

Plugin Details

Severity: Critical

ID: 10632

File Name: smb_nt_ms00-086.nasl

Version: $Revision: 1.45 $

Type: local

Agent: windows

Published: 2001/03/12

Modified: 2017/05/26

Dependencies: 57033, 13855

Risk Information

Risk Factor: Critical


Base Score: 10

Temporal Score: 8.3

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Temporal Vector: CVSS2#E:F/RL:OF/RC:C


Base Score: 9.8

Temporal Score: 9

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:F/RL:O/RC:C

Vulnerability Information

CPE: cpe:/o:microsoft:windows, cpe:/a:microsoft:iis

Required KB Items: SMB/MS_Bulletin_Checks/Possible

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 2000/11/06

Vulnerability Publication Date: 2000/11/07

Reference Information

CVE: CVE-2000-0886

BID: 1912

OSVDB: 525

MSFT: MS00-086

MSKB: 277873