CVE-2002-0364: Buffer Overflow
First published: Wed Jul 03 2002(Updated: )
Buffer overflow in the chunked encoding transfer mechanism in IIS 4.0 and 5.0 allows attackers to execute arbitrary code via the processing of HTR request sessions, aka "Heap Overrun in HTR Chunked Encoding Could Enable Web Server Compromise."
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Microsoft Internet Information Services | =4.0 | |
| Microsoft Internet Information Services (IIS) | =5.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://archives.neohapsis.com/archives/vulnwatch/2002-q2/0099.html
- http://online.securityfocus.com/archive/1/276767
- http://www.kb.cert.org/vuls/id/313819
- http://www.securityfocus.com/bid/4855
- http://www.iss.net/security_center/static/9327.php
- http://marc.info/?l=ntbugtraq&m=102392308608100&w=2
- http://marc.info/?l=bugtraq&m=102392069305962&w=2
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A29
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A182
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-028
Frequently Asked Questions
What is the severity of CVE-2002-0364?
CVE-2002-0364 is considered a critical vulnerability due to the potential for arbitrary code execution.
How do I fix CVE-2002-0364?
To fix CVE-2002-0364, upgrade to a more secure version of Internet Information Services, such as IIS 6.0 or later.
What software is affected by CVE-2002-0364?
CVE-2002-0364 affects Microsoft Internet Information Server versions 4.0 and 5.0.
Can CVE-2002-0364 be exploited remotely?
Yes, CVE-2002-0364 can be exploited remotely by attackers through specially crafted HTR requests.
What are the consequences of exploiting CVE-2002-0364?
Exploitation of CVE-2002-0364 can lead to a full compromise of the web server, allowing the attacker to execute malicious code.
- agent/references
- agent/type
- agent/first-publish-date
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/severity
- agent/last-modified-date
- agent/author
- agent/event
- agent/description
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- collector/nvd-historical
- vendor/microsoft
- product/internet information services
- canonical/microsoft internet information services
- product/internet information server
- canonical/microsoft internet information server
- version/microsoft internet information services/4.0
- canonical/microsoft internet information services (iis)
- version/microsoft internet information services (iis)/5.0