High severity · published Mar 23, 2006
CVE-2006-1364
Microsoft w3wp (aka w3wp.exe) does not properly handle when the AspCompat directive is not used when referencing COM components in ASP.NET, which allows remote attackers to cause…
7.5
CVSS
58.7%
EPSS
No
On KEV
Description
Microsoft w3wp (aka w3wp.exe) does not properly handle when the AspCompat directive is not used when referencing COM components in ASP.NET, which allows remote attackers to cause a denial of service (resource consumption or crash) by repeatedly requesting each of several documents that refer to COM components, or are restricted documents located under the ASP.NET application path.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)58.7% · higher than 99% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AS
Asp.net · Microsoft
through 1.1; 1.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2006-1364
CVE.org
https://www.cve.org/CVERecord?id=CVE-2006-1364
Broken Link
http://hackingspirits.com/vuln-rnd/w3wp-remote-dos.zip
Third Party Advisory
http://lists.grok.org.uk/pipermail/full-disclosure/2006-March/044291.html
Third Party Advisory
http://lists.grok.org.uk/pipermail/full-disclosure/2006-March/044292.html
Third Party Advisory
http://securitytracker.com/id?1015825
Exploit
http://www.securiteam.com/windowsntfocus/5KP0O0KI0Y.html
www.securityfocus.com
http://www.securityfocus.com/archive/1/428622/100/0/threaded
More from Asp.net
9.8
CVE-2004-0847
The Microsoft .NET forms authentication capability for ASP.NET allows remote attackers to bypass authentication for .aspx files in restricted directories via a request containing…
–
CVE-2010-2088
ASP.NET in Microsoft .NET 3.5 does not properly handle an unencrypted view state, which allows remote attackers to conduct cross-site scripting (XSS) attacks against the form…
–
CVE-2010-2084
Microsoft ASP.NET 2.0 does not prevent setting the InnerHtml property on a control that inherits from HtmlContainerControl, which allows remote attackers to conduct cross-site…
–
CVE-2005-2224
aspnet_wp.exe in Microsoft ASP.NET web services allows remote attackers to cause a denial of service (CPU consumption from infinite loop) via a crafted SOAP message to an…
–
CVE-2005-1665
The __VIEWSTATE functionality in Microsoft ASP.NET 1.x, when not cryptographically signed, allows remote attackers to cause a denial of service (CPU consumption) via deeply nested…