high7.5Public exploit code
CVE-2001-0333
Directory traversal vulnerability in IIS 5.0 and earlier allows remote attackers to execute arbitrary commands by encoding ..
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Microsoft IIS 3.0/4.0/5.0 - PWS Escaped Characters Decoding Command Execution (8)2001-05-15 · remote · windows · Verified
- Microsoft IIS 3.0/4.0/5.0 - PWS Escaped Characters Decoding Command Execution (7)2001-05-15 · remote · windows · Verified
- Microsoft IIS 3.0/4.0/5.0 - PWS Escaped Characters Decoding Command Execution (6)2001-05-15 · remote · windows · Verified
- Microsoft IIS 3.0/4.0/5.0 - PWS Escaped Characters Decoding Command Execution (5)2001-05-15 · remote · windows · Verified
- Microsoft IIS 3.0/4.0/5.0 - PWS Escaped Characters Decoding Command Execution (4)2001-05-15 · remote · windows · Verified
- Microsoft IIS 3.0/4.0/5.0 - PWS Escaped Characters Decoding Command Execution (3)2001-05-15 · remote · windows · Verified
- Microsoft IIS 3.0/4.0/5.0 - PWS Escaped Characters Decoding Command Execution (2)2001-05-16 · remote · windows · Verified
- Microsoft IIS 3.0/4.0/5.0 - PWS Escaped Characters Decoding Command Execution (1)2001-05-15 · remote · windows · Verified
- Microsoft IIS/PWS - CGI Filename Double Decode Command Execution (MS01-026) (Metasploit)2011-01-08 · remote · windows · Verified
Impact
Directory traversal vulnerability in IIS 5.0 and earlier allows remote attackers to execute arbitrary commands by encoding .. (dot dot) and "\" characters twice.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Microsoft | Internet Information Server | through 5.0 Version 4.0 |
References
- NVD record
- CVE.org record
- http://marc.info/?l=bugtraq&m=98992056521300&w=2
- http://www.cert.org/advisories/CA-2001-12.html
- http://www.securityfocus.com/bid/2708
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2001/ms01-026
- https://exchange.xforce.ibmcloud.com/vulnerabilities/6534
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1018
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1051
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A37
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A78
- http://marc.info/?l=bugtraq&m=98992056521300&w=2
- http://www.cert.org/advisories/CA-2001-12.html
- http://www.securityfocus.com/bid/2708
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2001/ms01-026
- https://exchange.xforce.ibmcloud.com/vulnerabilities/6534
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1018
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1051
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A37
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A78