CVE-2006-6578
Microsoft Internet Information Services 5.1 - Arbitrary Command Execution via .COM File Arguments
Title source: llmDescription
Microsoft Internet Information Services (IIS) 5.1 permits the IUSR_Machine account to execute non-EXE files such as .COM files, which allows attackers to execute arbitrary commands via arguments to any .COM file that executes those arguments, as demonstrated using win.com when it is in a web directory with certain permissions.
References (2)
Core 2
Core References
Exploit, Third Party Advisory third-party-advisory
x_refsource_sreason
http://securityreason.com/securityalert/2036
Exploit, Third Party Advisory, VDB Entry mailing-list
x_refsource_bugtraq
http://www.securityfocus.com/archive/1/454268/100/0/threaded
Scores
EPSS
0.0697
EPSS Percentile
93.5%
Details
Status
published
Products (1)
microsoft/internet_information_services
5.1
Published
Dec 15, 2006
Tracked Since
Feb 18, 2026