CVE-2001-1243: Medium severity Microsoft Internet Information Server vulnerability

Published Jul 4, 2001

Updated

Scripting.FileSystemObject in asp.dll for Microsoft IIS 4.0 and 5.0 allows local or remote attackers to cause a denial of service (crash) via (1) creating an ASP program that uses Scripting.FileSystemObject to open a file with an MS-DOS device name, or (2) remotely injecting the device name into ASP programs that internally use Scripting.FileSystemObject.

Affected Software

2 affected components

Microsoft Internet Information Server=4.0

Microsoft Internet Information Services=5.0

Remediation

Patch Available

http://www.securityfocus.com/bid/2973

Event History

Jul 4, 2001

CVE Published

04:00 AM

May 3, 2002

CVE Published

via MITRE·08:00 AM

Data Sourced

via MITRE·08:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2001-1243?

CVE-2001-1243 is considered a denial of service vulnerability that can crash Microsoft IIS 4.0 and 5.0.

How do I fix CVE-2001-1243?

To fix CVE-2001-1243, ensure that you apply the latest patches provided by Microsoft for IIS 4.0 and 5.0.

What versions of Microsoft IIS are affected by CVE-2001-1243?

CVE-2001-1243 affects Microsoft Internet Information Server versions 4.0 and 5.0.

What kind of attack does CVE-2001-1243 involve?

CVE-2001-1243 involves creating an ASP program that manipulates the FileSystemObject to open files with MS-DOS device names.

Can CVE-2001-1243 be exploited remotely?

Yes, CVE-2001-1243 can be exploited remotely by injecting device names into ASP applications.