Description
The w3svc.dll ISAPI filter in Front Page Server Extensions and ASP.NET for Internet Information Server (IIS) 4.0, 5.0, and 5.1 does not properly handle the error condition when a long URL is provided, which allows remote attackers to cause a denial of service (crash) when the URL parser accesses a null pointer.
References
- 4479 vdb-entry
- VU#521059 third-party-advisory
- iis-isapi-filter-error-dos(8800) vdb-entry
- 20020411 KPMG-2002009: Microsoft IIS W3SVC Denial of Service mailing-list
- MS02-018 vendor-advisory
- 3326 vdb-entry
- CA-2002-09 third-party-advisory
- 20020415 Microsoft IIS Vulnerabilities in Cisco Products - MS02-018 vendor-advisory