National Vulnerability Database (CVE-2002-0364)

National Cyber-Alert System Vulnerability Summary: CVE-2002-0364
Orirignal release date: 2002-07-03 Source: US-CERT/NIST ### Overview Buffer overflow in the chunked encoding transfer mechanism in IIS 4.0 and 5.0 allows attackers to execute arbitrary code via the processing of HTR request sessions, aka &quot;Heap Overrun in HTR Chunked Encoding Could Enable Web Server Compromise.&quot; ### Impact CVSS Severity: 7 (High) Range: remote Authentication: input buffer="1" Impact Type: sec_prot other="1" ### Reference to Advisories, Solutions, and Tools External Source: The Aims Group Name: amp Hyperlink: http://marc.theaimsgroup.com/?l=bugtraq& External Source: Security Focus Name: bid 4855 Hyperlink: http://online.securityfocus.com/bid/4855 External Source: Microsoft Name: Heap Overrun in HTR Chunked Encoding Could Enable Web Server Compromise (Q321599) Hyperlink: http://www.microsoft.com/technet/security/bulletin/ms02-028.asp ### Vulnerable Software and Vendor IIS (Microsoft) Technical Details CVE Standard Vulnerability Entry: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-0364