Sign-up

ID

VAR-200204-0012


CVE

CVE-2002-0079


TITLE

Microsoft Internet Information Server (IIS) 4.0 and 5.0 buffer overflow in chunked encoding transfer mechanism for ASP

Trust: 0.8

sources: CERT/CC: VU#610291

DESCRIPTION

Buffer overflow in the chunked encoding transfer mechanism in Internet Information Server (IIS) 4.0 and 5.0 Active Server Pages allows attackers to cause a denial of service or execute arbitrary code. This condition affects IIS 4.0 and IIS 5.0. Exploitation of this vulnerability may result in a denial of service or allow for a remote attacker to execute arbitrary instructions on the victim host. Microsoft IIS 5.0 is reported to ship with a default script (iisstart.asp) which may be sufficient for a remote attacker to exploit. Other sample scripts may also be exploitable. A number of Cisco products are affected by this vulnerability, although this issue is not present in the Cisco products themselves

Trust: 3.6

sources: NVD: CVE-2002-0079 // CERT/CC: VU#610291 // CERT/CC: VU#669779 // JVNDB: JVNDB-2002-000082 // BID: 4485 // BID: 4490

AFFECTED PRODUCTS

vendor:microsoftmodel: - scope: - version: -

Trust: 1.6

vendor:microsoftmodel:internet information serverscope:eqversion:4.0

Trust: 1.6

vendor:microsoftmodel:internet information servicesscope:eqversion:5.0

Trust: 1.6

vendor:microsoftmodel:iisscope:eqversion:5.0

Trust: 1.4

vendor:microsoftmodel:iisscope:eqversion:4.0

Trust: 1.4

vendor:microsoftmodel:iisscope:eqversion:5.1

Trust: 1.1

vendor:ciscomodel:unity serverscope:eqversion:2.4

Trust: 0.6

vendor:ciscomodel:unity serverscope:eqversion:2.3

Trust: 0.6

vendor:ciscomodel:unity serverscope:eqversion:2.2

Trust: 0.6

vendor:ciscomodel:unity serverscope:eqversion:2.1

Trust: 0.6

vendor:ciscomodel:unity serverscope:eqversion:2.0

Trust: 0.6

vendor:ciscomodel:call managerscope:eqversion:3.2

Trust: 0.6

vendor:ciscomodel:call managerscope:eqversion:3.1

Trust: 0.6

vendor:ciscomodel:call managerscope:eqversion:3.0

Trust: 0.6

vendor:ciscomodel:building broadband service managerscope:eqversion:5.1

Trust: 0.6

vendor:ciscomodel:building broadband service managerscope:eqversion:5.0

Trust: 0.6

vendor:ciscomodel:building broadband service managerscope:eqversion:4.5

Trust: 0.6

vendor:ciscomodel:building broadband service managerscope:eqversion:4.4

Trust: 0.6

vendor:ciscomodel:building broadband service managerscope:eqversion:4.3

Trust: 0.6

vendor:ciscomodel:building broadband service managerscope:eqversion:4.2

Trust: 0.6

vendor:ciscomodel:building broadband service managerscope:eqversion:4.0.1

Trust: 0.6

vendor:microsoftmodel:internet information serverscope:eqversion:5.0

Trust: 0.6

sources: CERT/CC: VU#610291 // CERT/CC: VU#669779 // BID: 4485 // BID: 4490 // JVNDB: JVNDB-2002-000082 // CNNVD: CNNVD-200204-041 // NVD: CVE-2002-0079

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2002-0079
value: HIGH

Trust: 1.0

CARNEGIE MELLON: VU#610291
value: 62.44

Trust: 0.8

CARNEGIE MELLON: VU#669779
value: 50.02

Trust: 0.8

NVD: CVE-2002-0079
value: HIGH

Trust: 0.8

CNNVD: CNNVD-200204-041
value: HIGH

Trust: 0.6

nvd@nist.gov: CVE-2002-0079
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

sources: CERT/CC: VU#610291 // CERT/CC: VU#669779 // JVNDB: JVNDB-2002-000082 // CNNVD: CNNVD-200204-041 // NVD: CVE-2002-0079

PROBLEMTYPE DATA

problemtype:NVD-CWE-Other

Trust: 1.0

sources: NVD: CVE-2002-0079

THREAT TYPE

network

Trust: 0.6

sources: BID: 4485 // BID: 4490

TYPE

Boundary Condition Error

Trust: 1.2

sources: BID: 4485 // BID: 4490 // CNNVD: CNNVD-200204-041

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2002-000082

PATCH
title:MS02-018url:http://www.microsoft.com/technet/security/bulletin/MS02-018.asp
Trust: 0.8
title:MS02-018url:http://www.microsoft.com/japan/technet/security/bulletin/MS02-018.mspx
Trust: 0.8
sources:
            
            
            JVNDB: JVNDB-2002-000082

EXTERNAL IDS
db:CERT/CCid:VU#610291
Trust: 3.5
db:BIDid:4485
Trust: 3.0
db:NVDid:CVE-2002-0079
Trust: 2.4
db:BIDid:4490
Trust: 1.1
db:CERT/CCid:VU#669779
Trust: 1.1
db:JVNDBid:JVNDB-2002-000082
Trust: 0.8
db:CERT/CCid:CA-2002-09
Trust: 0.6
db:MSid:MS02-018
Trust: 0.6
db:BUGTRAQid:20020410 WINDOWS 2000 AND NT4 IIS .ASP REMOTE BUFFER OVERFLOW
Trust: 0.6
db:XFid:8795
Trust: 0.6
db:OVALid:OVAL:ORG.MITRE.OVAL:DEF:16
Trust: 0.6
db:OVALid:OVAL:ORG.MITRE.OVAL:DEF:25
Trust: 0.6
db:CISCOid:20020415 MICROSOFT IIS VULNERABILITIES IN CISCO PRODUCTS - MS02-018
Trust: 0.6
db:CNNVDid:CNNVD-200204-041
Trust: 0.6
sources:
            
            
            CERT/CC: VU#610291 // 
            
            
            
            CERT/CC: VU#669779 // 
            
            
            
            BID: 4485 // 
            
            
            
            BID: 4490 // 
            
            
            
            JVNDB: JVNDB-2002-000082 // 
            
            
            
            CNNVD: CNNVD-200204-041 // 
            
            
            
            NVD: CVE-2002-0079

REFERENCES
url:http://www.kb.cert.org/vuls/id/610291
Trust: 3.7
url:http://www.securityfocus.com/bid/4485
Trust: 3.4
url:http://www.cert.org/advisories/ca-2002-09.html
Trust: 3.4
url:http://www.iss.net/security_center/static/8795.php
Trust: 2.6
url:http://www.cisco.com/warp/public/707/microsoft-iis-vulnerabilities-ms02-018.shtml
Trust: 2.6
url:http://www.microsoft.com/technet/security/bulletin/ms02-018.asp
Trust: 2.2
url:http://marc.info/?l=bugtraq&m=101846993304518&w=2
Trust: 2.0
url:https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-018
Trust: 2.0
url:https://oval.cisecurity.org/repository/search/definition/oval%3aorg.mitre.oval%3adef%3a16
Trust: 2.0
url:https://oval.cisecurity.org/repository/search/definition/oval%3aorg.mitre.oval%3adef%3a25
Trust: 2.0
url:http://www.eeye.com/html/research/advisories/ad20020410.html
Trust: 1.6
url:http://www.microsoft.com/technet/security/urlscan.asp
Trust: 0.8
url:http://www.microsoft.com/technet/security/tools/locktool.asp
Trust: 0.8
url:http://www.securityfocus.com/bid/4490
Trust: 0.8
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2002-0079
Trust: 0.8
url:http://www.jpcert.or.jp/wr/2002/wr021401.txt
Trust: 0.8
url:http://jvn.jp/cert/jvnca-2002-09
Trust: 0.8
url:http://nvd.nist.gov/nvd.cfm?cvename=cve-2002-0079
Trust: 0.8
url:http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/ms02-018.asp
Trust: 0.6
url:http://support.microsoft.com/default.aspx?scid=kb;en-us;q317636
Trust: 0.6
url:http://www.microsoft.com/technet/security/advisory/default.mspx
Trust: 0.6
url:http://marc.theaimsgroup.com/?l=bugtraq&m=101846993304518&w=2
Trust: 0.6
url:http://oval.mitre.org/repository/data/getdef?id=oval:org.mitre.oval:def:25
Trust: 0.6
url:http://oval.mitre.org/repository/data/getdef?id=oval:org.mitre.oval:def:16
Trust: 0.6
url:http://support.coresecurity.com/impact/exploits/505b3e16f67af18142eee44ea0c41656.html
Trust: 0.3
url:http://online.securityfocus.com/bid/4485
Trust: 0.3
url:http://www.kb.cert.org/vuls/id/669779
Trust: 0.3
sources:
            
            
            CERT/CC: VU#610291 // 
            
            
            
            CERT/CC: VU#669779 // 
            
            
            
            BID: 4485 // 
            
            
            
            BID: 4490 // 
            
            
            
            JVNDB: JVNDB-2002-000082 // 
            
            
            
            CNNVD: CNNVD-200204-041 // 
            
            
            
            NVD: CVE-2002-0079

CREDITS
Riley Hassell※ riley@eeye.com
Trust: 0.6
sources:
            
            
            CNNVD: CNNVD-200204-041

SOURCES
db:CERT/CCid:VU#610291
db:CERT/CCid:VU#669779
db:BIDid:4485
db:BIDid:4490
db:JVNDBid:JVNDB-2002-000082
db:CNNVDid:CNNVD-200204-041
db:NVDid:CVE-2002-0079

LAST UPDATE DATE
2024-11-22T22:59:28.508000+00:00

SOURCES UPDATE DATE
db:CERT/CCid:VU#610291date:2002-06-13T00:00:00
db:CERT/CCid:VU#669779date:2002-06-13T00:00:00
db:BIDid:4485date:2002-04-10T00:00:00
db:BIDid:4490date:2002-04-10T00:00:00
db:JVNDBid:JVNDB-2002-000082date:2007-04-01T00:00:00
db:CNNVDid:CNNVD-200204-041date:2005-05-02T00:00:00
db:NVDid:CVE-2002-0079date:2024-11-20T23:38:15.473

SOURCES RELEASE DATE
db:CERT/CCid:VU#610291date:2002-04-10T00:00:00
db:CERT/CCid:VU#669779date:2002-04-10T00:00:00
db:BIDid:4485date:2002-04-10T00:00:00
db:BIDid:4490date:2002-04-10T00:00:00
db:JVNDBid:JVNDB-2002-000082date:2007-04-01T00:00:00
db:CNNVDid:CNNVD-200204-041date:2002-04-22T00:00:00
db:NVDid:CVE-2002-0079date:2002-04-22T04:00:00