header-logo
Suggest Exploit
vendor:
IIS
by:
SecurityFocus
7.5
CVSS
HIGH
Microsoft IIS 5.0 Denial of Service
400
CWE
Product Name: IIS
Affected Version From: Microsoft IIS 5.0
Affected Version To: Microsoft IIS 5.0
Patch Exists: YES
Related CWE: CVE-2001-0333
CPE: a:microsoft:iis:5.0
Metasploit: N/A
Other Scripts: N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References: N/A
Nuclei Metadata: N/A
Platforms Tested: Windows
2001

Microsoft IIS 5.0 Denial of Service

A flaw in the WebDav extensions of Microsoft IIS 5.0 allows a remote attacker to carry out a Denial of Service attack by repeatedly requesting nonexistent files via the HTTP LOCK method. This leads to a complete consumption of memory resources, eventually crashing the host and requiring a restart.

Mitigation:

Microsoft has released a patch to address this issue.
Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/2736/info

Microsoft IIS 5.0 is vulnerable to a denial of service attack.

A flaw in the WebDav extensions allow a remote attacker to carry out a DoS by repeatedly requesting nonexistent files via the HTTP LOCK method.

This leads to a complete consumption of memory resources, eventually crashing the host and requiring a restart.

LOCK /aaaaaaaaaaaaaaaaaaaaaaaaaa.htw HTTP/1.0

One way is to combine the attack with asp executions, eg.

GET /iisstart.asp?uc=a HTTP/1.0

Navigation

Suggest Exploit

Services By CQR