Sign-up

ID

VAR-200211-0047


CVE

CVE-2002-1181


TITLE

Microsoft IIS Of admin Web Site cross-site scripting vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2002-000265

DESCRIPTION

Multiple cross-site scripting (XSS) vulnerabilities in the administrative web pages for Microsoft Internet Information Server (IIS) 4.0 through 5.1 allow remote attackers to execute HTML script as other users through (1) a certain ASP file in the IISHELP virtual directory, or (2) possibly other unknown attack vectors. This vulnerability was originally described in BugTraq ID 6068. It is now being assigned its own BugTraq ID. Microsoft Internet Information Services (IIS) is prone to multiple vulnerabilities. The first vulnerability may allow an attacker to obtain elevated privileges. This vulnerability can be exploited by an attacker to load and execute applications on the vulnerable server with SYSTEM level privileges. This vulnerability can exploited when IIS is configured to run applications out of process. The second vulnerability may allow a remote attacker to cause a denial of service condition. This vulnerability is related to how IIS allocates memory for WebDAV requests. Any specially crafted WebDAV requests may result in IIS allocating an extremely large amount of memory on the server. Several malformed requests sent to the server will result in the vulnerable system failing to respond to further legitimate requests for service. This vulnerability affects IIS 5.0 and 5.1 only. The third vulnerability may allow a remote attacker to upload a file onto the vulnerable server and possibly execute it. The vulnerability is a result of inappropriate listing of file types that are subject to the script source access permission in IIS 5.0. As a result an attacker may be able to upload malicious files to a vulnerable server and possibly execute it. This vulnerability only affects IIS 5.0. The final vulnerability is a cross site scripting vulnerability. The vulnerability is a result of improper sanitization of user-supplied input by IIS. Several web pages, provided by IIS for administrative purposes do not adequately sanitize user-supplied input. Any malicious HTML code that may be included in the URI will be executed

Trust: 2.16

sources: NVD: CVE-2002-1181 // JVNDB: JVNDB-2002-000265 // BID: 6072 // BID: 6068

AFFECTED PRODUCTS

vendor:microsoftmodel:internet information serverscope:eqversion:4.0

Trust: 1.6

vendor:microsoftmodel:internet information servicesscope:eqversion:5.0

Trust: 1.6

vendor:microsoftmodel:iisscope:eqversion:5.1

Trust: 1.4

vendor:microsoftmodel:iisscope:eqversion:5.0

Trust: 1.4

vendor:microsoftmodel:iisscope:eqversion:4.0

Trust: 1.4

vendor:microsoftmodel:internet information serverscope:eqversion:5.0

Trust: 0.6

vendor:microsoftmodel:internet information serverscope:eqversion:5.1

Trust: 0.6

sources: BID: 6072 // BID: 6068 // JVNDB: JVNDB-2002-000265 // CNNVD: CNNVD-200211-022 // NVD: CVE-2002-1181

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2002-1181
value: MEDIUM

Trust: 1.0

NVD: CVE-2002-1181
value: MEDIUM

Trust: 0.8

CNNVD: CNNVD-200211-022
value: MEDIUM

Trust: 0.6

nvd@nist.gov: CVE-2002-1181
severity: MEDIUM
baseScore: 6.8
vectorString: AV:N/AC:M/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 8.6
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

sources: JVNDB: JVNDB-2002-000265 // CNNVD: CNNVD-200211-022 // NVD: CVE-2002-1181

PROBLEMTYPE DATA

problemtype:NVD-CWE-Other

Trust: 1.0

sources: NVD: CVE-2002-1181

THREAT TYPE

network

Trust: 0.6

sources: BID: 6072 // BID: 6068

TYPE

other

Trust: 0.6

sources: CNNVD: CNNVD-200211-022

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2002-000265

PATCH
title:MS02-062url:http://www.microsoft.com/technet/security/bulletin/MS02-062.mspx
Trust: 0.8
title:MS02-062url:http://www.microsoft.com/japan/technet/security/bulletin/MS02-062.mspx
Trust: 0.8
title:Microsoft IIS Repair measures for cross-site scripting vulnerabilities in management pagesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=134895
Trust: 0.6
sources:
            
            
            JVNDB: JVNDB-2002-000265 // 
            
            
            
            CNNVD: CNNVD-200211-022

EXTERNAL IDS
db:NVDid:CVE-2002-1181
Trust: 3.0
db:BIDid:6068
Trust: 2.7
db:BIDid:6072
Trust: 1.9
db:JVNDBid:JVNDB-2002-000265
Trust: 0.8
db:CNNVDid:CNNVD-200211-022
Trust: 0.6
sources:
            
            
            BID: 6072 // 
            
            
            
            BID: 6068 // 
            
            
            
            JVNDB: JVNDB-2002-000265 // 
            
            
            
            CNNVD: CNNVD-200211-022 // 
            
            
            
            NVD: CVE-2002-1181

REFERENCES
url:http://www.securityfocus.com/bid/6068
Trust: 3.4
url:http://www.iss.net/security_center/static/10501.php
Trust: 2.6
url:http://www.ciac.org/ciac/bulletins/n-011.shtml
Trust: 2.6
url:https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-062
Trust: 2.6
url:http://www.securityfocus.com/bid/6072
Trust: 2.6
url:https://oval.cisecurity.org/repository/search/definition/oval%3aorg.mitre.oval%3adef%3a944
Trust: 2.6
url:http://marc.info/?l=bugtraq&m=103651224215736&w=2
Trust: 2.6
url:http://www.lac.co.jp/security/intelligence/snsadvisory/58.html
Trust: 2.6
url:https://oval.cisecurity.org/repository/search/definition/oval%3aorg.mitre.oval%3adef%3a942
Trust: 2.6
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2002-1181
Trust: 0.8
url:http://nvd.nist.gov/nvd.cfm?cvename=cve-2002-1181
Trust: 0.8
url:http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/ms02-062.asp
Trust: 0.6
url:/archive/1/298544
Trust: 0.3
sources:
            
            
            BID: 6072 // 
            
            
            
            BID: 6068 // 
            
            
            
            JVNDB: JVNDB-2002-000265 // 
            
            
            
            CNNVD: CNNVD-200211-022 // 
            
            
            
            NVD: CVE-2002-1181

CREDITS
This vulnerability was first described in a Microsoft Security Bulletin.
Trust: 0.3
sources:
            
            
            BID: 6072

SOURCES
db:BIDid:6072
db:BIDid:6068
db:JVNDBid:JVNDB-2002-000265
db:CNNVDid:CNNVD-200211-022
db:NVDid:CVE-2002-1181

LAST UPDATE DATE
2024-11-22T22:54:15.782000+00:00

SOURCES UPDATE DATE
db:BIDid:6072date:2009-07-11T18:06:00
db:BIDid:6068date:2009-07-11T18:06:00
db:JVNDBid:JVNDB-2002-000265date:2007-04-01T00:00:00
db:CNNVDid:CNNVD-200211-022date:2020-11-25T00:00:00
db:NVDid:CVE-2002-1181date:2024-11-20T23:40:45.907

SOURCES RELEASE DATE
db:BIDid:6072date:2002-10-31T00:00:00
db:BIDid:6068date:2002-10-30T00:00:00
db:JVNDBid:JVNDB-2002-000265date:2007-04-01T00:00:00
db:CNNVDid:CNNVD-200211-022date:2002-05-27T00:00:00
db:NVDid:CVE-2002-1181date:2002-11-12T05:00:00