9

CVE-2009-3023

Exploit

Buffer overflow in the FTP Service in Microsoft Internet Information Services (IIS) 5.0 through 6.0 allows remote authenticated users to execute arbitrary code via a crafted NLST (NAME LIST) command that uses wildcards, leading to memory corruption, aka "IIS FTP Service RCE and DoS Vulnerability."

Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Microsoft ≫ Internet Information Server Version >= 5.0 <= 6.0
   Microsoft ≫ Windows 2000 Version- Updatesp4
   Microsoft ≫ Windows Server 2003 Version- Updatesp2 HwPlatformitanium
   Microsoft ≫ Windows Server 2003 Version- Updatesp2 HwPlatformx64
   Microsoft ≫ Windows Xp Version- Updatesp2
   Microsoft ≫ Windows Xp Version- Updatesp2 SwEditionprofessional HwPlatformx64
   Microsoft ≫ Windows Xp Version- Updatesp3
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 77.22% 0.989
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 9 8 10
AV:N/AC:L/Au:S/C:C/I:C/A:C
CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.

http://www.us-cert.gov/cas/techalerts/TA09-286A.html
Third Party Advisory
US Government Resource
http://www.exploit-db.com/exploits/9541
Third Party Advisory
Exploit
VDB Entry
http://www.exploit-db.com/exploits/9559
Third Party Advisory
Exploit
VDB Entry
http://www.kb.cert.org/vuls/id/276653
Third Party Advisory
US Government Resource
http://www.securityfocus.com/bid/36189
Third Party Advisory
Exploit
VDB Entry