CVE-2002-0371 Buffer overflow in gopher client for Microsoft Internet Explorer 5.1 through 6.0, Proxy Server 2.0, or ISA Server 2000 allows remote attackers to execute arbitrary code via a gopher:// URL that redire...
HighCVSS 7.5
EPSS 54.4%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Buffer overflow in gopher client for Microsoft Internet Explorer 5.1 through 6.0, Proxy Server 2.0, or ISA Server 2000 allows remote attackers to execute arbitrary code via a gopher:// URL that redirects the user to a real or simulated gopher server that sends a long response.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Microsoft internet explorer | = 5.0.1 | No fix listed |
| Microsoft internet explorer | = 5.0.1-sp1 | No fix listed |
| Microsoft internet explorer | = 5.0.1-sp2 | No fix listed |
| Microsoft internet explorer | = 5.5 | No fix listed |
| Microsoft internet explorer | = 5.5-sp1 | No fix listed |
| Microsoft internet explorer | = 5.5-sp2 | No fix listed |
| Microsoft internet explorer | = 6.0 | No fix listed |
| Microsoft isa server | = 2000 | No fix listed |
| Microsoft isa server | = 2000-sp1 | No fix listed |
| Microsoft proxy server | = 2.0 | No fix listed |
| Microsoft proxy server | = 2.0-sp1 | No fix listed |
| university of minnesota gopher | All versions | No fix listed |
References
- 20020604 Buffer overflow in MSIE gopher code mailing-list
- 20020613 Microsoft releases critical fix that breaks their own software! mailing-list
- 20020613 Flawed workaround in MS02-027 -- gopher can run on _any_ port, not just 70 mailing-list
- ie-gopher-bo(9247) vdb-entry
- VU#440275 third-party-advisory us-government-resource
- www.pivx.com
- 4930 vdb-entry
- MS02-027 vendor-advisory
- oval:org.mitre.oval:def:98 signature vdb-entry