CVE-2001-1243 Scripting.FileSystemObject in asp.dll for Microsoft IIS 4.0 and 5.0 allows local or remote attackers to cause a denial of service (crash) via (1) creating an ASP program that uses Scripting.FileSystem...
MediumCVSS 5.0
EPSS 70.5%
PoC
- Published
- Updated
- Exploit status
- Proof-of-concept only
Description
Scripting.FileSystemObject in asp.dll for Microsoft IIS 4.0 and 5.0 allows local or remote attackers to cause a denial of service (crash) via (1) creating an ASP program that uses Scripting.FileSystemObject to open a file with an MS-DOS device name, or (2) remotely injecting the device name into ASP programs that internally use Scripting.FileSystemObject.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Microsoft internet information server | = 4.0 | No fix listed |
| Microsoft internet information services | = 5.0 | No fix listed |
References
- iis-device-asp-dos(6800) vdb-entry vendor-advisory
- 20010704 NERF Advisory #4: MS IIS local and remote DoS mailing-list
- 2973 exploit patch vdb-entry vendor-advisory