CVE-2002-2081 Denial of service in n/a
Remote attackers can cause denial of service and disk consumption in Microsoft Site Server by sending a crafted HTTP POST request with a long TargetURL parameter.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2002-2081?
CVE-2002-2081 is a medium-severity denial of service vulnerability in n/a, published on 14 Jul 2005. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
cphost.dll in Microsoft Site Server 3.0 allows remote attackers to cause a denial of service (disk consumption) via an HTTP POST of a file with a long TargetURL parameter, which causes Site Server to abort and leaves the uploaded file in c:\temp.
Which versions are affected by CVE-2002-2081?
It affects 2 products.
Products include Microsoft Site Server, Microsoft Site Server Commerce.
How do I fix CVE-2002-2081?
No fix has been published for CVE-2002-2081 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2002-2081 being exploited?
There is no known exploitation of CVE-2002-2081 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2002-1769 Hardcoded credentials in n/a
- CVE-1999-1246 Information disclosure in n/a
- CVE-2000-0161 SQL injection in n/a
- CVE-1999-0360 MS Site Server 2.0 with IIS 4 can allow users to upload content, including ASP, to the target web site, thus allowing them to execute commands remotely.
- CVE-1999-1520 Information disclosure in n/a
Sources
Also known as GHSA-737h-px7x-jjwj.