CVE - CVE-2007-2897

CVE-ID
CVE-2007-2897	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
Microsoft Internet Information Services (IIS) 6.0 allows remote attackers to cause a denial of service (server instability or device hang), and possibly obtain sensitive information (device communication traffic); and might allow attackers with physical access to execute arbitrary code after connecting a data stream to a device COM port; via requests for a URI containing a '/' immediately before and after the name of a DOS device, as demonstrated by the /AUX/.aspx URI, which bypasses a blacklist for DOS device requests.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
FULLDISC:20070522 Question Regarding IIS 6.0 / Is this a DoS??? URL:http://seclists.org/fulldisclosure/2007/May/0378.html FULLDISC:20070523 Re: Question Regarding IIS 6.0 / Is this a DoS??? URL:http://archives.neohapsis.com/archives/fulldisclosure/2007-05/0419.html XF:iis-auxaspx-dos(34418) URL:https://exchange.xforce.ibmcloud.com/vulnerabilities/34418
Assigning CNA
MITRE Corporation
Date Record Created
20070529	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20070529)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)