CVE-2005-4360

The URL parser in Microsoft Internet Information Services (IIS) 5.1 on Windows XP Professional SP2 allows remote attackers to execute arbitrary code via multiple requests to ".dll" followed by arguments such as "~0" through "~9", which causes ntdll.dll to produce a return value that is not correctly handled by IIS, as demonstrated using "/_vti_bin/.dll/*/~0". NOTE: the consequence was originally believed to be only a denial of service (application crash and reboot).

CVSS v2.0 7.8 HIGH

7.8^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:N/I:C/A:N

Exploitability : 10.0 / Impact : 6.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact COMPLETE

Availability Impact NONE

References

Link	Resource
http://archive.cert.uni-stuttgart.de/bugtraq/2007/07/msg00254.html	Issue Tracking Third Party Advisory
http://ingehenriksen.blogspot.com/2005/12/microsoft-iis-remote-dos-dll-url.html	Exploit Vendor Advisory
http://secunia.com/advisories/18106	Exploit Vendor Advisory
http://securityreason.com/securityalert/271	Third Party Advisory
http://securitytracker.com/alerts/2005/Dec/1015376.html	Third Party Advisory VDB Entry
http://www.osvdb.org/21805	Broken Link
http://www.securityfocus.com/archive/1/419707/100/0/threaded	Third Party Advisory VDB Entry
http://www.securityfocus.com/bid/15921	Third Party Advisory VDB Entry
http://www.us-cert.gov/cas/techalerts/TA07-191A.html	Third Party Advisory US Government Resource
http://www.vupen.com/english/advisories/2005/2963	Vendor Advisory
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-041	Patch Vendor Advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1703	Third Party Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:a:microsoft:internet_information_services:5.1:*:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_xp:-:sp2:*:*:professional:*:-:*

History

No history.

Information

Published : 2005-12-20 01:03

Updated : 2021-11-08 21:45

NVD link : CVE-2005-4360

Mitre link : CVE-2005-4360

CVE.ORG link : CVE-2005-4360

JSON object : View

Products Affected

microsoft

internet_information_services
windows_xp

CWE

CWE-252

Unchecked Return Value

{"id": "CVE-2005-4360", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:C/A:N", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 6.9, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2005-12-20T01:03:00.000", "references": [{"url": "http://archive.cert.uni-stuttgart.de/bugtraq/2007/07/msg00254.html", "tags": ["Issue Tracking", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "http://ingehenriksen.blogspot.com/2005/12/microsoft-iis-remote-dos-dll-url.html", "tags": ["Exploit", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/18106", "tags": ["Exploit", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://securityreason.com/securityalert/271", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "http://securitytracker.com/alerts/2005/Dec/1015376.html", "tags": ["Third Party Advisory", "VDB Entry"], "source": "cve@mitre.org"}, {"url": "http://www.osvdb.org/21805", "tags": ["Broken Link"], "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/archive/1/419707/100/0/threaded", "tags": ["Third Party Advisory", "VDB Entry"], "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/15921", "tags": ["Third Party Advisory", "VDB Entry"], "source": "cve@mitre.org"}, {"url": "http://www.us-cert.gov/cas/techalerts/TA07-191A.html", "tags": ["Third Party Advisory", "US Government Resource"], "source": "cve@mitre.org"}, {"url": "http://www.vupen.com/english/advisories/2005/2963", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-041", "tags": ["Patch", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1703", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-252"}]}], "descriptions": [{"lang": "en", "value": "The URL parser in Microsoft Internet Information Services (IIS) 5.1 on Windows XP Professional SP2 allows remote attackers to execute arbitrary code via multiple requests to \".dll\" followed by arguments such as \"~0\" through \"~9\", which causes ntdll.dll to produce a return value that is not correctly handled by IIS, as demonstrated using \"/_vti_bin/.dll/*/~0\". NOTE: the consequence was originally believed to be only a denial of service (application crash and reboot)."}], "lastModified": "2021-11-08T21:45:47.557", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:internet_information_services:5.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "25100F8C-58A0-49D5-8247-8CCD099A734B"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:windows_xp:-:sp2:*:*:professional:*:-:*", "vulnerable": false, "matchCriteriaId": "C5D2C681-EB06-4B72-BD34-47AEE35CC227"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@mitre.org"}