Vulnerability Description
The ASP function Response.AddHeader in Microsoft Internet Information Server (IIS) 4.0 and 5.0 does not limit memory requests when constructing headers, which allow remote attackers to generate a large header to cause a denial of service (memory consumption) with an ASP page.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Microsoft | Internet Information Server | 4.0 |
| Microsoft | Internet Information Services | 5.0 |
References
- http://marc.info/?l=ntbugtraq&m=105110606122772&w=2
- http://www.aqtronix.com/Advisories/AQ-2003-01.txt
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2003/ms03-01
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3
- http://marc.info/?l=ntbugtraq&m=105110606122772&w=2
- http://www.aqtronix.com/Advisories/AQ-2003-01.txt
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2003/ms03-01
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3
FAQ
What is CVE-2003-0225?
CVE-2003-0225 is a vulnerability with a CVSS score of 5.0 (MEDIUM). The ASP function Response.AddHeader in Microsoft Internet Information Server (IIS) 4.0 and 5.0 does not limit memory requests when constructing headers, which allow remote attackers to generate a larg...
How severe is CVE-2003-0225?
CVE-2003-0225 has been rated MEDIUM with a CVSS base score of 5.0/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2003-0225?
Check the references section above for vendor advisories and patch information. Affected products include: Microsoft Internet Information Server, Microsoft Internet Information Services.