exploits , vulnerabilities , articles , Microsoft IIS 5.0 .printer ISAPI Extension Buffer Overflow Vulnerability

Title	Microsoft IIS 5.0 .printer ISAPI Extension Buffer Overflow Vulnerability
Published	2001-05-01-12:00AM
Updated	2005-02-07-09:07PM
Class	Boundary Condition Error
CVE	CVE-2001-0241
Remote	Yes
Local	No
Credit	Discovered by Riley Hassel of eEye Digital Security and posted in a Microsoft Security Bulletin MS01-023 on May 1, 2001.
Vulnerable	Microsoft IIS 5.0 Microsoft Windows 2000 Advanced Server Microsoft Windows 2000 Advanced Server SP1 Microsoft Windows 2000 Advanced Server SP2 Microsoft Windows 2000 Datacenter Server SP1 Microsoft Windows 2000 Datacenter Server SP2 Microsoft Windows 2000 Professional Microsoft Windows 2000 Professional SP1 Microsoft Windows 2000 Professional SP2 Microsoft Windows 2000 Server Microsoft Windows 2000 Server SP1 Microsoft Windows 2000 Server SP2
Not Vulnerable
Code	CORE has developed a working commercial exploit for their IMPACT product. This exploit is not otherwise publicly available or known to be circulating in the wild. Ryan Permeh of eEye Digital Security released the following 'iishack2000.c' exploit. Wanderley J. Abreu Jr. <storm@unikey.com.br> has provided the following memory leak 'iiswebexplt.pl' exploit. dark spyrit <dspyrit@beavuh.org> has provided the following 'jill.c' exploit. Cyrus The Great <cyrusarmy@yahoo.com> has provided the following 'iis5hack.zip' exploit. The exploits provided may not work on Japanese version of IIS. This does not necessarily mean Japanese IIS is not vulnerable. An exploit has been released as part of the MetaSploit Framework 2.0. Exploit code has also been provided by sectroyer <sectroyer@o2.pl>. Proof of concept iis_printer_bof.c was provided by Daniele Spaccini (styx^) <the.styx@gmail.com>. /data/vulnerabilities/exploits/iishack2000.c /data/vulnerabilities/exploits/jill.c /data/vulnerabilities/exploits/iiswebexplt.pl /data/vulnerabilities/exploits/iis5hack.zip /data/vulnerabilities/exploits/iis50_printer_overflow.pm /data/vulnerabilities/exploits/sol2k.c /data/vulnerabilities/exploits/iis_printer_bof.c
TXT

Vulnerabilities - newest 10 RSS | More

2008-12-02 xrdp Multiple Buffer Overflow Vulnerabilities
2008-12-02 FFmpeg Multiple Denial of Service Vulnerabilities
2008-12-01 SystemImager Flamethrower Insecure Temporary File Creation Vulnerabilities
2008-12-01 Rumpus FTP Server Command Argument Remote Buffer Overflow Vulnerability
2008-12-01 Rumpus FTP Server HTTP Command Remote Denial of Service Vulnerability
2008-11-29 Multiple ActiveWebSoftwares Products Login Parameters SQL Injection Vulnerabilities
2008-11-29 Venalsur Booking Centre Multiple Cross-Site Scripting Vulnerabilities
2008-11-28 ReVou Login SQL Injection Vulnerability
2008-11-28 Web Calendar System SQL Injection and Cross Site Scripting Vulnerabilities
2008-11-28 SailPlanner Login SQL Injection Vulnerability