CVE-2005-4360

45Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendepss 87%

from disclosure to weapon0 days

Published on NVDDec 20

1st PoCDec 19

exploitation probability

87%top 1% of all CVEs

observed exploitation

nono source reports it

2 public exploit(s)

The URL parser in Microsoft Internet Information Services (IIS) 5.1 on Windows XP Professional SP2 allows remote attackers to execute arbitrary code via multiple requests to ".dll" followed by arguments such as "~0" through "~9", which causes ntdll.dll to produce a return value that is not correctly handled by IIS, as demonstrated using "/_vti_bin/.dll/*/~0". NOTE: the consequence was originally believed to be only a denial of service (application crash and reboot).

Affected products

n/a · n/a

public PoCs found — 2✓ VexDay Proof

exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/1376 exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/1377

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

http://archive.cert.uni-stuttgart.de/bugtraq/2007/07/msg00254.html http://ingehenriksen.blogspot.com/2005/12/microsoft-iis-remote-dos-dll-url.html https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-041 http://secunia.com/advisories/18106 http://securityreason.com/securityalert/271 http://securitytracker.com/alerts/2005/Dec/1015376.html https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1703 http://www.osvdb.org/21805 http://www.securityfocus.com/archive/1/419707/100/0/threaded http://www.securityfocus.com/bid/15921 http://www.us-cert.gov/cas/techalerts/TA07-191A.html http://www.vupen.com/english/advisories/2005/2963