The URL parser in Microsoft Internet Information Services (IIS) 5.1 on Windows XP Professional SP2 allows remote attackers to execute arbitrary code via multiple requests to ".dll" followed by arguments such as "~0" through "~9", which causes ntdll.dll to produce a return value that is not correctly handled by IIS, as demonstrated using "/_vti_bin/.dll/*/~0". NOTE: the consequence was originally believed to be only a denial of service (application crash and reboot).
References
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: mitre
Published: 2005-12-20T01:00:00
Updated: 2018-10-19T14:57:01
Reserved: 2005-12-20T00:00:00
Link: CVE-2005-4360
JSON object: View
NVD Information
Status : Analyzed
Published: 2005-12-20T01:03:00.000
Modified: 2021-11-08T21:45:47.557
Link: CVE-2005-4360
JSON object: View
Redhat Information
No data.
CWE