CVE-1999-1223

IIS 4.0 allows attackers to cause a denial of service by requesting a large buffer in a POST or PUT command, leading to memory exhaustion.

IIS allows local users to cause a denial of service via invalid regular expressions in a Visual Basic script in an ASP page.

IIS 4.0 allows a remote attacker to obtain the real pathname of the document root by requesting non-existent files with .ida or .idq extensions.

IIS 4.0 does not properly restrict access for the initial session request from a user's IP address if the address does not resolve to a DNS domain. This is known as the 'Domain Resolution' vulnerability.

IIS does not properly canonicalize URLs, potentially allowing remote attackers to bypass access restrictions in third-party software via escape characters.

Vulnerability in IIS 4.0 allows a denial of service attack by flooding the server with HTTP requests containing malformed headers.

Buffer overflow in IIS 4.0 allows remote attackers to cause a denial of service via a malformed request for files with .HTR, .IDC, or .STM extensions.

By default, IIS 4.0 has a virtual directory /IISADMPWD which contains files that can be used as proxies for brute force password attacks, or to identify valid users on the system.

In IIS, an attacker could determine a real path using a request for a non-existent URL that would be interpreted by Perl (perl.exe).

The ExAir sample site in IIS 4 allows remote attackers to cause a denial of service (CPU consumption) via a direct request to the (1) advsearch.asp, (2) query.asp, or (3) search.asp scripts.