MS02-026: ASP.NET Worker Process StateServer Mode Remote Overflow (322289)

Medium Nessus Plugin ID 11306


Arbitrary code can be executed on the remote host.


The remote ASP.NET installation might be vulnerable to a buffer overflow when an application enables StateServer mode.

An attacker could use it to cause a denial of service or run arbitrary code with the same privileges as the process being exploited (typically an unprivileged account).


Microsoft has released a set of patches for ASP.NET.

See Also

Plugin Details

Severity: Medium

ID: 11306

File Name: smb_nt_ms02-026.nasl

Version: $Revision: 1.35 $

Type: local

Agent: windows

Published: 2003/03/02

Modified: 2017/05/26

Dependencies: 57033, 10428, 10531, 10394, 10150

Risk Information

Risk Factor: Medium


Base Score: 6.8

Temporal Score: 5

Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P

Temporal Vector: CVSS2#E:U/RL:OF/RC:C


Base Score: 7.3

Temporal Score: 6.4

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/, cpe:/a:microsoft:.net_framework

Required KB Items: SMB/MS_Bulletin_Checks/Possible

Exploit Available: false

Exploit Ease: No known exploits are available

Patch Publication Date: 2002/06/06

Vulnerability Publication Date: 2004/04/08

Reference Information

CVE: CVE-2002-0369

BID: 4958

OSVDB: 5314

MSFT: MS02-026

MSKB: 322289