Multiple Microsoft IIS Vulnerabilities



Date Discovered

October 30, 2002


Microsoft Internet Information Services (IIS) is prone to multiple vulnerabilities. The first vulnerability may allow an attacker to obtain elevated privileges. This vulnerability can be exploited by an attacker to load and execute applications on the vulnerable server with SYSTEM level privileges. This vulnerability can exploited when IIS is configured to run applications out of process. The second vulnerability may allow a remote attacker to cause a denial of service condition. This vulnerability is related to how IIS allocates memory for WebDAV requests. Any specially crafted WebDAV requests may result in IIS allocating an extremely large amount of memory on the server. Several malformed requests sent to the server will result in the vulnerable system failing to respond to further legitimate requests for service. This vulnerability affects IIS 5.0 and 5.1 only. The third vulnerability may allow a remote attacker to upload a file onto the vulnerable server and possibly execute it. The vulnerability is a result of inappropriate listing of file types that are subject to the script source access permission in IIS 5.0. As a result an attacker may be able to upload malicious files to a vulnerable server and possibly execute it. This vulnerability only affects IIS 5.0. The final vulnerability is a cross site scripting vulnerability. The vulnerability is a result of improper sanitization of user-supplied input by IIS. Several web pages, provided by IIS for administrative purposes do not adequately sanitize user-supplied input. Any malicious HTML code that may be included in the URI will be executed.

Technologies Affected

  • Microsoft IIS 4.0
  • Microsoft IIS 5.0
  • Microsoft IIS 5.1


Block external access at the network boundary, unless external parties require service.
For services not meant for public use, restrict access to trusted hosts and networks only.

Disallow anonymous access to services. Permit access for trusted individuals only.
Do not allow unknown or untrusted individuals to upload files onto critical or sensitive systems.

Do not follow links provided by unknown or untrusted sources.
Be extremely cautious before following any links from suspicious or unknown sources.

Modify default configuration files to disable any unwanted behavior.
Delete any sample files and directories that may be installed by default.

Fixes available:



Li0n of A3 Security Consulting Co., Ltd. (, Mark Litchfield of Next Generation Security Software Ltd. (, and Luciano Martins of Deloitte & Touche Argentina ( are credited for these issues.

© 1995- Symantec Corporation

Permission to redistribute this alert electronically is granted as long as it is not edited in any way unless authorized by Symantec Security Response. Reprinting the whole or part of this alert in any medium other than electronically requires permission from


The information in the advisory is believed to be accurate at the time of publishing based on currently available information. Use of the information constitutes acceptance for use in an AS IS condition. There are no warranties with regard to this information. Neither the author nor the publisher accepts any liability for any direct, indirect, or consequential loss or damage arising from use of, or reliance on, this information.

Symantec, Symantec products, Symantec Security Response, and are registered trademarks of Symantec Corp. and/or affiliated companies in the United States and other countries. All other registered and unregistered trademarks represented in this document are the sole property of their respective companies/owners.