CVE-2005-4360

Severity: high (CVSS 7.8 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 86.7% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2005-12-20 · updated 2026-06-16
Weakness: CWE-252

Description

The URL parser in Microsoft Internet Information Services (IIS) 5.1 on Windows XP Professional SP2 allows remote attackers to execute arbitrary code via multiple requests to ".dll" followed by arguments such as "~0" through "~9", which causes ntdll.dll to produce a return value that is not correctly handled by IIS, as demonstrated using "/_vti_bin/.dll/*/~0". NOTE: the consequence was originally believed to be only a denial of service (application crash and reboot).

Affected products

Microsoft IIS: 5.1

References

http://archive.cert.uni-stuttgart.de/bugtraq/2007/07/msg00254.html
http://ingehenriksen.blogspot.com/2005/12/microsoft-iis-remote-dos-dll-url.html
http://secunia.com/advisories/18106
http://securityreason.com/securityalert/271
http://securitytracker.com/alerts/2005/Dec/1015376.html
http://www.osvdb.org/21805
http://www.securityfocus.com/archive/1/419707/100/0/threaded
http://www.securityfocus.com/bid/15921
http://www.us-cert.gov/cas/techalerts/TA07-191A.html
http://www.vupen.com/english/advisories/2005/2963
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-041
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1703

Get alerted when CVE-2005-4360 or the next vulnerability affects your stack