CVE-2001-0876 Memory corruption in n/a
Remote attackers can execute arbitrary code on Windows systems via a buffer overflow in the UPnP service using a malformed NOTIFY request.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2001-0876?
CVE-2001-0876 is a high-severity memory corruption vulnerability in Microsoft Windows 98, published on 9 Mar 2002. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Buffer overflow in Universal Plug and Play (UPnP) on Windows 98, 98SE, ME, and XP allows remote attackers to execute arbitrary code via a NOTIFY directive with a long Location URL.
Which versions are affected by CVE-2001-0876?
It affects 4 products.
Products include Microsoft Windows 98, Microsoft Windows 98se, Microsoft Windows Me, Microsoft Windows Xp.
How do I fix CVE-2001-0876?
No fix has been published for CVE-2001-0876 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2001-0876 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2001-0876 exists.
Public exploit code: 2 Exploit-DB entries.
Other vulnerabilities in Microsoft Windows 98
- CVE-2006-2376 Integer overflow in n/a
- CVE-2002-1183 Microsoft Windows 98 and Windows NT 4.0 do not properly verify the Basic Constraints of digital certificates, allowing remote attackers to e
- CVE-2001-1055 Denial of service in n/a
- CVE-2001-0877 Denial of service in n/a
- CVE-2001-0721 Denial of service in n/a
Sources
Also known as GHSA-fxhg-8327-3c3x.