IIS vulnerabilities

IIS 4.0 allows attackers to cause a denial of service by requesting a large buffer in a POST or PUT command, leading to memory exhaustion.

IIS allows local users to cause a denial of service via invalid regular expressions in a Visual Basic script in an ASP page.

IIS 4.0 allows a remote attacker to obtain the real pathname of the document root by requesting non-existent files with .ida or .idq extensions.

IIS 4.0 does not properly restrict access for the initial session request from a user's IP address if the address does not resolve to a DNS domain. This is known as the 'Domain Resolution' vulnerability.

IIS 3.0 allows remote attackers to cause a denial of service via a request to an ASP page in which the URL contains a large number of / (forward slash) characters.

IIS does not properly canonicalize URLs, potentially allowing remote attackers to bypass access restrictions in third-party software via escape characters.

Vulnerability in IIS 4.0 allows a denial of service attack by flooding the server with HTTP requests containing malformed headers.

Buffer overflow in IIS 4.0 allows remote attackers to cause a denial of service via a malformed request for files with .HTR, .IDC, or .STM extensions.

By default, IIS 4.0 has a virtual directory /IISADMPWD which contains files that can be used as proxies for brute force password attacks, or to identify valid users on the system.

In IIS, an attacker could determine a real path using a request for a non-existent URL that would be interpreted by Perl (perl.exe).

The ExAir sample site in IIS 4 allows remote attackers to cause a denial of service (CPU consumption) via a direct request to the (1) advsearch.asp, (2) query.asp, or (3) search.asp scripts.

When upgrading from IIS 2 or 3 to IIS 4, the ism.dll file is left in the /scripts/iisadmin directory, which does not restrict access to the local machine. This allows an unauthorized user to gain access to sensitive server information, including the Administrator's password.

The #exec function is enabled for Server Side Include (SSI) files in IIS, which may lead to unauthorized command execution on the server.

In IIS, remote attackers can obtain source code for ASP files by appending '::$DATA' to the URL.

CVE-1999-0281 vulnerability involves a denial of service attack in IIS that can be triggered by sending long URLs.

IIS 3.0 with the iis-fix hotfix installed allows remote intruders to read source code for ASP programs by using a %2e instead of a dot in the URL.

IIS 1.0 allows users to execute arbitrary commands using .bat or .cmd files.