Remote Code Execution Vulnerability in Microsoft IIS 5.1 and 6.0
CVE-2005-2678

Currently unrated

Key Information:

Vendor
Microsoft
Status
Internet Information Server
Internet Information Services
Vendor
CVE Published:
23 August 2005

Summary

The vulnerability in Microsoft IIS 5.1 and 6.0 allows remote attackers to spoof the SERVER_NAME variable, enabling them to bypass security checks. This can lead to unauthorized actions or access through a specially crafted GET request utilizing the http://localhost URI. By manipulating request headers, attackers can effectively disguise their actions as originating from the local server, thus compromising the security integrity of the application.

References

http://ingehenriksen.blogspot.com/2005/08/remote-iis-5x-a...
x_refsource_MISC
http://www.vupen.com/english/advisories/2005/1503
vdb-entryx_refsource_VUPEN
http://secunia.com/advisories/16548
third-party-advisoryx_refsource_SECUNIA

EPSS Score

61% chance of being exploited in the next 30 days.

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.