CVE-2001-0500

Buffer overflow in ISAPI extension (idq.dll) in Index Server 2.0 and Indexing Service 2000 in IIS 6.0 beta and earlier allows remote attackers to execute arbitrary commands via a long argument to Internet Data Administration (.ida) and Internet Data Query (.idq) files such as default.ida, as commonly exploited by Code Red.

CVSS v2.0 NVD

10.0 HIGHAV:N/AC:L/Au:N/C:C/I:C/A:C

EPSS

96.73% chance of exploitation in the next 30 days, 100th percentile

Published

2002-03-09

Updated

2024-08-08

Metasploit modules (1)

• rapid7/metasploit-framework/blob/master/modules/exploits/windows/iis/ms01_033_idq.rb

ExploitDB entries (5)

• https://www.exploit-db.com/exploits/20933
• https://www.exploit-db.com/exploits/20932
• https://www.exploit-db.com/exploits/20931
• https://www.exploit-db.com/exploits/20930
• https://www.exploit-db.com/exploits/16472

Security advisories

• http://www.cert.org/advisories/CA-2001-13.html
• http://www.securityfocus.com/bid/2880
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2001/ms01-033

References

• CVE Record
• NVD entry