CVE-2005-4360

Description

The URL parser in Microsoft Internet Information Services (IIS) 5.1 on Windows XP Professional SP2 allows remote attackers to execute arbitrary code via multiple requests to .dll followed by arguments such as ~0 through ~9, which causes ntdll.dll to produce a return value that is not correctly handled by IIS, as demonstrated using /_vti_bin/.dll/*/~0. NOTE: the consequence was originally believed to be only a denial of service (application crash and reboot).

Risk Information

Base Score

9.8

MODERATE

Vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score

Exploitation Probability

77.063

Associated Vulnerability

Vulnerability	OS Platform
Security Update for Windows XP (KB939373)	Windows

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234