CVE-2001-1243

Description

Scripting.FileSystemObject in asp.dll for Microsoft IIS 4.0 and 5.0 allows local or remote attackers to cause a denial of service (crash) via (1) creating an ASP program that uses Scripting.FileSystemObject to open a file with an MS-DOS device name, or (2) remotely injecting the device name into ASP programs that internally use Scripting.FileSystemObject.

Affected products

• microsoft / internet_information_server4.0 – 4.0
• microsoft / internet_information_services5.0 – 5.0

Exploits & proofs of concept

• exploit-dbMicrosoft IIS 4.0/5.0 - Device File Remote Denial of Serviceby VIPER_SV
• exploit-dbMicrosoft IIS 4.0/5.0 - Device File Local Denial of Serviceby VIPER_SV

References

• MISChttp://www.iss.net/security_center/static/6800.php
• MISChttp://www.securityfocus.com/bid/2973
• MISChttp://www.securityfocus.com/archive/1/194919