CVE-1999-0874

Buffer overflow in IIS 4.0 allows remote attackers to cause a denial of service via a malformed request for files with .HTR, .IDC, or .STM extensions

published June 2, 2000

Patch now

High probability of exploitation

NVD has not assigned a CVSS score to this record. It sits in the 99.5th percentile for exploit probability.

CVSS
—
EPSS
75%
Percentile
99.5
In the wild
Unconfirmed
What it is

⚠️ A crafty malformed request could bring IIS 4.0 to its knees! This buffer overflow lets remote attackers cause a denial of service by misusing specific file extensions. 🔥 Think of IIS 4.0 as a restaurant that serves specialized dishes. A customer sends in a bizarre order for an item that doesn’t exist, and suddenly the kitchen is overwhelmed, unable to fulfill any orders! If exploited, this vulnerability could crash your server, leading to downtime that impacts your users and business. Imagine your digital restaurant unable to serve customers because of one confusing order. This denial of service could have cascading effects on your online presence and reputation.

Put simply

Think of IIS 4.0 as a restaurant that serves specialized dishes. A customer sends in a bizarre order for an item that doesn’t exist, and suddenly the kitchen is overwhelmed, unable to fulfill any orders! This vulnerability arises from a buffer overflow flaw within IIS 4.0, triggered by malformed requests specifically targeting files with .HTR, .IDC, or .STM extensions, causing the server to crash.

What to do

If exploited, this vulnerability could crash your server, leading to downtime that impacts your users and business. Imagine your digital restaurant unable to serve customers because of one confusing order. This denial of service could have cascading effects on your online presence and reputation. To mitigate this risk, consider applying patches relevant to IIS 4.0 and review your web server configuration. It's also wise to monitor your server logs for unusual request patterns and implement stricter input validation. 🛡️ You've got this! With a few adjustments, you can keep your server safe and sound. 🚀

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.74651 · 99.5th percentile
Published
2000-06-02T04:00Z
EPSS history
Timeline
  • 02 JUN 04:00Z
    Buffer overflow in IIS 4.0 allows remote attackers to cause a denial of service via a malformed request for files with .HTR, .IDC, or .STM extensions
    cvelistv5