CVE-2002-0072: Medium severity Microsoft Internet Information Server vulnerability
The w3svc.dll ISAPI filter in Front Page Server Extensions and ASP.NET for Internet Information Server (IIS) 4.0, 5.0, and 5.1 does not properly handle the error condition when a long URL is provided, which allows remote attackers to cause a denial of service (crash) when the URL parser accesses a null pointer.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2002-0072?
The severity of CVE-2002-0072 is classified as high due to its potential to cause a denial of service.
How do I fix CVE-2002-0072?
To fix CVE-2002-0072, it is recommended to upgrade to a version of Internet Information Server that is not affected or to implement proper input validation on URLs.
Which versions of IIS are affected by CVE-2002-0072?
CVE-2002-0072 affects Internet Information Services 4.0, 5.0, and 5.1.
What exploit is associated with CVE-2002-0072?
CVE-2002-0072 can be exploited by sending specially crafted long URLs that cause the w3svc.dll ISAPI filter to crash.
Are there any workarounds for CVE-2002-0072?
While there are no specific workarounds for CVE-2002-0072, limiting the maximum length of URLs may help in mitigating the risk.