Description

Scripting.FileSystemObject in asp.dll for Microsoft IIS 4.0 and 5.0 allows local or remote attackers to cause a denial of service (crash) via (1) creating an ASP program that uses Scripting.FileSystemObject to open a file with an MS-DOS device name, or (2) remotely injecting the device name into ASP programs that internally use Scripting.FileSystemObject.

Remediation

References

CVE-2001-1243

Related Vulnerabilities

WebLogic CVE-2020-2547 Vulnerability (CVE-2020-2547)

OpenSSL Resource Management Errors Vulnerability (CVE-2014-3506)

PHP Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability (CVE-2012-2376)

phpList Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2017-20029)

WordPress Plugin GD Star Rating 'votes' Parameter SQL Injection (1.9.8)

Severity

Medium

Classification

CVE-2001-1243

Tags

Missing Update Known Vulnerabilities