Description
Microsoft w3wp (aka w3wp.exe) does not properly handle when the AspCompat directive is not used when referencing COM components in ASP.NET, which allows remote attackers to cause a denial of service (resource consumption or crash) by repeatedly requesting each of several documents that refer to COM components, or are restricted documents located under the ASP.NET application path.
CVSS breakdown
CVSS 3.0
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
Affected products
- Microsoft / ASP.NET1.1
- Microsoft / ASP.NET1.1 – 1.1
References
- MISChttp://www.securityfocus.com/archive/1/428622/100/0/threaded
- MISChttp://hackingspirits.com/vuln-rnd/w3wp-remote-dos.zip
- MISChttp://securitytracker.com/id?1015825
- MISChttp://www.securityfocus.com/bid/17188
- MISChttps://exchange.xforce.ibmcloud.com/vulnerabilities/25392
- EXPLOIThttps://www.exploit-db.com/exploits/1601
- MISChttp://www.securiteam.com/windowsntfocus/5KP0O0KI0Y.html
- MAILING_LISThttp://lists.grok.org.uk/pipermail/full-disclosure/2006-March/044291.html
- MAILING_LISThttp://lists.grok.org.uk/pipermail/full-disclosure/2006-March/044292.html
Updated 46m ago · 2 sources