critical10.0Public exploit code
CVE-2001-0500
Buffer overflow in ISAPI extension (idq.dll) in Index Server 2.0 and Indexing Service 2000 in IIS 6.0 beta and earlier allows remote attackers to execute arbit…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Microsoft Index Server 2.0 / Indexing Service (Windows 2000) - ISAPI Extension Buffer Overflow (4)2001-06-18 · remote · windows · Verified
- Microsoft Index Server 2.0 / Indexing Service (Windows 2000) - ISAPI Extension Buffer Overflow (3)2001-06-18 · remote · windows · Verified
- Microsoft Index Server 2.0 / Indexing Service (Windows 2000) - ISAPI Extension Buffer Overflow (2)2001-06-21 · remote · windows · Verified
- Microsoft Index Server 2.0 / Indexing Service (Windows 2000) - ISAPI Extension Buffer Overflow (PoC)2001-06-18 · dos · windows · Verified
- Microsoft IIS 5.0 - IDQ Path Overflow (MS01-033) (Metasploit)2010-06-15 · remote · windows · Verified
Impact
Buffer overflow in ISAPI extension (idq.dll) in Index Server 2.0 and Indexing Service 2000 in IIS 6.0 beta and earlier allows remote attackers to execute arbitrary commands via a long argument to Internet Data Administration (.ida) and Internet Data Query (.idq) files such as default.ida, as commonly exploited by Code Red.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Microsoft | Index Server | Version 2.0 |
| Microsoft | Indexing Service | All versions |
| Microsoft | Internet Information Server | through 6.0 |
References
- NVD record
- CVE.org record
- http://www.cert.org/advisories/CA-2001-13.html
- http://www.ciac.org/ciac/bulletins/l-098.shtml
- http://www.iss.net/security_center/static/6705.php
- http://www.securityfocus.com/archive/1/191873
- http://www.securityfocus.com/bid/2880
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2001/ms01-033
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A197
- http://www.cert.org/advisories/CA-2001-13.html
- http://www.ciac.org/ciac/bulletins/l-098.shtml
- http://www.iss.net/security_center/static/6705.php
- http://www.securityfocus.com/archive/1/191873
- http://www.securityfocus.com/bid/2880
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2001/ms01-033
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A197