CVE-2010-3972 Heap-based buffer overflow in the TELNET_STREAM_CONTEXT::OnSendData function in ftpsvc.dll in Microsoft FTP Service 7.0 and 7.5 for Internet Information Services (IIS) 7.0, and IIS 7.5, allows remote....
HighCVSS 10.0
EPSS 94.5%
Framework module
PoC
- Published
- Updated
- Exploit status
- Public exploit available
Description
Heap-based buffer overflow in the TELNET_STREAM_CONTEXT::OnSendData function in ftpsvc.dll in Microsoft FTP Service 7.0 and 7.5 for Internet Information Services (IIS) 7.0, and IIS 7.5, allows remote attackers to execute arbitrary code or cause a denial of service (daemon crash) via a crafted FTP command, aka "IIS FTP Service Heap Buffer Overrun Vulnerability." NOTE: some of these details are obtained from third party information.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Microsoft internet information services | = 7.5 | No fix listed |
References
- blogs.technet.com
- 42713 third-party-advisory vendor-advisory
- 15803 exploit
- VU#842372 third-party-advisory us-government-resource
- 45542 exploit vdb-entry
- 1024921 vdb-entry
- ADV-2010-3305 vdb-entry vendor-advisory
- MS11-004 vendor-advisory
- ms-iis-onsenddata-bo(64248) vdb-entry
- oval:org.mitre.oval:def:12370 signature vdb-entry