CVE-2006-1364

Severity: high (CVSS 7.5 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 58.7% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2006-03-23 · updated 2026-06-16
Weakness: CWE-400

Description

Microsoft w3wp (aka w3wp.exe) does not properly handle when the AspCompat directive is not used when referencing COM components in ASP.NET, which allows remote attackers to cause a denial of service (resource consumption or crash) by repeatedly requesting each of several documents that refer to COM components, or are restricted documents located under the ASP.NET application path.

Affected products

Microsoft Corporation ASP.NET: through 1.1; 1.1-sp1

References

http://hackingspirits.com/vuln-rnd/w3wp-remote-dos.zip
http://lists.grok.org.uk/pipermail/full-disclosure/2006-March/044291.html
http://lists.grok.org.uk/pipermail/full-disclosure/2006-March/044292.html
http://securitytracker.com/id?1015825
http://www.securiteam.com/windowsntfocus/5KP0O0KI0Y.html
http://www.securityfocus.com/archive/1/428622/100/0/threaded
http://www.securityfocus.com/bid/17188
https://exchange.xforce.ibmcloud.com/vulnerabilities/25392
https://www.exploit-db.com/exploits/1601
http://hackingspirits.com/vuln-rnd/w3wp-remote-dos.zip
http://lists.grok.org.uk/pipermail/full-disclosure/2006-March/044291.html
http://lists.grok.org.uk/pipermail/full-disclosure/2006-March/044292.html

Get alerted when CVE-2006-1364 or the next vulnerability affects your stack