Description
A certain ActiveX control in adsiis.dll in Microsoft Internet Information Services (IIS) allows remote attackers to cause a denial of service (browser crash) via a long string in the second argument to the GetObject method. NOTE: this issue was disclosed by an unreliable researcher, so it might be incorrect.
References
- 20080924 Internet Information Service (adsiis.dll) activex remote DOS mailing-list
- iis-adsiis-activex-dos(45584) vdb-entry
- 4325 third-party-advisory