Sign-up

ID

VAR-200204-0018


CVE

CVE-2002-0149


TITLE

Microsoft Internet Information Server (IIS) buffer overflow in server-side includes (SSI) containing long invalid file name

Trust: 0.8

sources: CERT/CC: VU#721963

DESCRIPTION

Buffer overflow in ASP Server-Side Include Function in IIS 4.0, 5.0 and 5.1 allows remote attackers to cause a denial of service and possibly execute arbitrary code via long file names. A condition exists that may allow for an existing bounds check on potentially user-supplied input to be bypassed, resulting in a potential buffer overflow. This condition affects IIS 4.0, IIS 5.0 and IIS 5.1. Exploitation requires that the attacker can influence when and how the file is included. Exploitation of this vulnerability may result in a denial of service or allow for a remote attacker to execute arbitrary instructions on the victim host. A number of Cisco products are affected by this vulnerability, although this issue is not present in the Cisco products themselves

Trust: 2.61

sources: NVD: CVE-2002-0149 // CERT/CC: VU#721963 // JVNDB: JVNDB-2002-000085 // BID: 4478

AFFECTED PRODUCTS

vendor:microsoftmodel:internet information serverscope:eqversion:4.0

Trust: 1.6

vendor:microsoftmodel:internet information servicesscope:eqversion:5.0

Trust: 1.6

vendor:microsoftmodel:iisscope:eqversion:5.1

Trust: 1.1

vendor:microsoftmodel:iisscope:eqversion:5.0

Trust: 1.1

vendor:microsoftmodel:iisscope:eqversion:4.0

Trust: 1.1

vendor:microsoftmodel: - scope: - version: -

Trust: 0.8

vendor:microsoftmodel:internet information serverscope:eqversion:5.0

Trust: 0.6

vendor:microsoftmodel:internet information serverscope:eqversion:5.1

Trust: 0.6

vendor:ciscomodel:unity serverscope:eqversion:2.4

Trust: 0.3

vendor:ciscomodel:unity serverscope:eqversion:2.3

Trust: 0.3

vendor:ciscomodel:unity serverscope:eqversion:2.2

Trust: 0.3

vendor:ciscomodel:unity serverscope:eqversion:2.1

Trust: 0.3

vendor:ciscomodel:unity serverscope:eqversion:2.0

Trust: 0.3

vendor:ciscomodel:call managerscope:eqversion:3.2

Trust: 0.3

vendor:ciscomodel:call managerscope:eqversion:3.1

Trust: 0.3

vendor:ciscomodel:call managerscope:eqversion:3.0

Trust: 0.3

vendor:ciscomodel:building broadband service managerscope:eqversion:5.1

Trust: 0.3

vendor:ciscomodel:building broadband service managerscope:eqversion:5.0

Trust: 0.3

vendor:ciscomodel:building broadband service managerscope:eqversion:4.5

Trust: 0.3

vendor:ciscomodel:building broadband service managerscope:eqversion:4.4

Trust: 0.3

vendor:ciscomodel:building broadband service managerscope:eqversion:4.3

Trust: 0.3

vendor:ciscomodel:building broadband service managerscope:eqversion:4.2

Trust: 0.3

vendor:ciscomodel:building broadband service managerscope:eqversion:4.0.1

Trust: 0.3

sources: CERT/CC: VU#721963 // BID: 4478 // JVNDB: JVNDB-2002-000085 // CNNVD: CNNVD-200204-023 // NVD: CVE-2002-0149

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2002-0149
value: HIGH

Trust: 1.0

CARNEGIE MELLON: VU#721963
value: 48.60

Trust: 0.8

NVD: CVE-2002-0149
value: HIGH

Trust: 0.8

CNNVD: CNNVD-200204-023
value: HIGH

Trust: 0.6

nvd@nist.gov: CVE-2002-0149
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

sources: CERT/CC: VU#721963 // JVNDB: JVNDB-2002-000085 // CNNVD: CNNVD-200204-023 // NVD: CVE-2002-0149

PROBLEMTYPE DATA

problemtype:NVD-CWE-Other

Trust: 1.0

sources: NVD: CVE-2002-0149

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-200204-023

TYPE

other

Trust: 0.6

sources: CNNVD: CNNVD-200204-023

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2002-000085

PATCH
title:MS02-018url:http://www.microsoft.com/technet/security/bulletin/MS02-018.asp
Trust: 0.8
title:MS02-018url:http://www.microsoft.com/japan/technet/security/Bulletin/MS02-018.mspx
Trust: 0.8
title:Microsoft Internet Information Services Buffer error vulnerability fixurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=134901
Trust: 0.6
sources:
            
            
            JVNDB: JVNDB-2002-000085 // 
            
            
            
            CNNVD: CNNVD-200204-023

EXTERNAL IDS
db:CERT/CCid:VU#721963
Trust: 3.5
db:BIDid:4478
Trust: 2.7
db:NVDid:CVE-2002-0149
Trust: 2.4
db:OSVDBid:3320
Trust: 1.6
db:JVNDBid:JVNDB-2002-000085
Trust: 0.8
db:CNNVDid:CNNVD-200204-023
Trust: 0.6
sources:
            
            
            CERT/CC: VU#721963 // 
            
            
            
            BID: 4478 // 
            
            
            
            JVNDB: JVNDB-2002-000085 // 
            
            
            
            CNNVD: CNNVD-200204-023 // 
            
            
            
            NVD: CVE-2002-0149

REFERENCES
url:http://www.kb.cert.org/vuls/id/721963
Trust: 3.7
url:http://www.cert.org/advisories/ca-2002-09.html
Trust: 3.4
url:http://www.securityfocus.com/bid/4478
Trust: 3.4
url:http://www.cisco.com/warp/public/707/microsoft-iis-vulnerabilities-ms02-018.shtml
Trust: 2.6
url:http://www.iss.net/security_center/static/8798.php
Trust: 2.6
url:https://oval.cisecurity.org/repository/search/definition/oval%3aorg.mitre.oval%3adef%3a95
Trust: 2.6
url:https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-018
Trust: 2.6
url:http://www.osvdb.org/3320
Trust: 2.6
url:https://oval.cisecurity.org/repository/search/definition/oval%3aorg.mitre.oval%3adef%3a132
Trust: 2.6
url:http://www.microsoft.com/technet/security/bulletin/ms02-018.asp
Trust: 0.8
url:http://www.microsoft.com/technet/security/tools/locktool.asp
Trust: 0.8
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2002-0149
Trust: 0.8
url:http://www.jpcert.or.jp/wr/2002/wr021401.txt
Trust: 0.8
url:http://jvn.jp/cert/jvnca-2002-09
Trust: 0.8
url:http://nvd.nist.gov/nvd.cfm?cvename=cve-2002-0149
Trust: 0.8
url:http://support.coresecurity.com/impact/exploits/d0742568f5f8552dace3837f2c597772.html
Trust: 0.3
url:http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/ms02-018.asp
Trust: 0.3
url:http://www.microsoft.com/technet/security
Trust: 0.3
url:http://support.microsoft.com/default.aspx?scid=kb;en-us;q317636
Trust: 0.3
sources:
            
            
            CERT/CC: VU#721963 // 
            
            
            
            BID: 4478 // 
            
            
            
            JVNDB: JVNDB-2002-000085 // 
            
            
            
            CNNVD: CNNVD-200204-023 // 
            
            
            
            NVD: CVE-2002-0149

CREDITS
Microsoft Security Team※ secure@microsoft.com
Trust: 0.6
sources:
            
            
            CNNVD: CNNVD-200204-023

SOURCES
db:CERT/CCid:VU#721963
db:BIDid:4478
db:JVNDBid:JVNDB-2002-000085
db:CNNVDid:CNNVD-200204-023
db:NVDid:CVE-2002-0149

LAST UPDATE DATE
2024-11-22T23:15:25.579000+00:00

SOURCES UPDATE DATE
db:CERT/CCid:VU#721963date:2002-04-10T00:00:00
db:BIDid:4478date:2002-04-10T00:00:00
db:JVNDBid:JVNDB-2002-000085date:2007-04-01T00:00:00
db:CNNVDid:CNNVD-200204-023date:2020-11-25T00:00:00
db:NVDid:CVE-2002-0149date:2024-11-20T23:38:25.667

SOURCES RELEASE DATE
db:CERT/CCid:VU#721963date:2002-04-10T00:00:00
db:BIDid:4478date:2002-04-10T00:00:00
db:JVNDBid:JVNDB-2002-000085date:2007-04-01T00:00:00
db:CNNVDid:CNNVD-200204-023date:2002-04-22T00:00:00
db:NVDid:CVE-2002-0149date:2002-04-22T04:00:00