CVE-2001-0506: Buffer Overflow

Published Sep 20, 2001

Updated

Buffer overflow in ssinc.dll in IIS 5.0 and 4.0 allows local users to gain system privileges via a Server-Side Includes (SSI) directive for a long filename, which triggers the overflow when the directory name is added, aka the "SSI privilege elevation" vulnerability.

Affected Software

2 affected components

Microsoft Internet Information Server=4.0

Microsoft Internet Information Services=5.0

Remediation

Patch Available

http://www.securityfocus.com/bid/3190

Event History

Sep 20, 2001

CVE Published

04:00 AM

Mar 9, 2002

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2001-0506?

CVE-2001-0506 is considered a high severity vulnerability due to its potential to allow local users to gain system privileges.

How do I fix CVE-2001-0506?

To fix CVE-2001-0506, it is recommended to upgrade to a patched version of Internet Information Services or apply any relevant security updates from Microsoft.

What versions of IIS are affected by CVE-2001-0506?

CVE-2001-0506 affects IIS 5.0 and Internet Information Server 4.0.

What type of attack does CVE-2001-0506 enable?

CVE-2001-0506 enables privilege escalation attacks through a buffer overflow vulnerability.

Who can exploit CVE-2001-0506?

CVE-2001-0506 can be exploited by local users with access to the affected IIS environments.