CVE-2010-1899
Internet Information Services 5.1-7.5 - Denial of Service via Crafted ASP Request
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2010-1899.
PoCs published by kingcope, erickrr-bd, including Metasploit module auxiliary/dos/windows/http/ms10_065_ii6_asp_dos.
AI-analyzed exploit summary This exploit targets a stack exhaustion vulnerability in Microsoft IIS 6.0 by sending a POST request with over 40,000 parameters, causing the IIS worker process to crash and leading to a denial of service (DoS). The PoC is written in Perl and demonstrates the attack by repeatedly sending malformed requests to an ASP page.
Description
Stack consumption vulnerability in the ASP implementation in Microsoft Internet Information Services (IIS) 5.1, 6.0, 7.0, and 7.5 allows remote attackers to cause a denial of service (daemon outage) via a crafted request, related to asp.dll, aka "IIS Repeated Parameter Request Denial of Service Vulnerability."
Exploits (3)
This exploit targets a stack exhaustion vulnerability in Microsoft IIS 6.0 by sending a POST request with over 40,000 parameters, causing the IIS worker process to crash and leading to a denial of service (DoS). The PoC is written in Perl and demonstrates the attack by repeatedly sending malformed requests to an ASP page.
This PoC demonstrates a DoS vulnerability in ASP by sending a large number of parameters in a POST request, causing resource exhaustion. The script iteratively increases the parameter count to test the target's resilience.
This Metasploit module exploits a stack exhaustion vulnerability in Microsoft IIS 6.0 by sending a large POST request with a repeated parameter, causing the server to become unresponsive. The exploit targets the handling of ASP scripts reading POST form values.