Unscored CVE-2001-0524 EUVD-2001-0517GHSA-6r42-r86w-9j76

eEye SecureIIS versions 1.0.3 and earlier does not perform length checking on individual HTTP headers, which allows a remote attacker to se…

Published Jul 27, 2001 · Updated Aug 8, 2024 · Assigned by mitre

Description

eEye SecureIIS versions 1.0.3 and earlier does not perform length checking on individual HTTP headers, which allows a remote attacker to send arbitrary length strings to IIS, contrary to an advertised feature of SecureIIS versions 1.0.3 and earlier.

References

20010519 RE: ASLabs-2001-01: Multiple Security Problems in eEye SecureIIS mailing-list
20010518 ASLabs-2001-01: Multiple Security Problems in eEye SecureIIS mailing-list
eeye-secureiis-http-header-bo(6574) vdb-entry