CVE-2001-0507

Vulnerability

IIS 5.0 uses relative paths to locate system files that run in-process. This design flaw allows an attacker to place a malicious Trojan horse file in a location that IIS will search before the legitimate system file, leading to privilege elevation. The vulnerability affects IIS 5.0 [1].

Exploitation

An attacker must have local user access to the IIS server. By placing a specially crafted Trojan horse file in a path traversed by IIS during its in-process file search, the attacker can cause IIS to load and execute the malicious file instead of the intended system file [1].

Impact

Successful exploitation allows the attacker to gain elevated privileges, potentially executing code with the same privileges as the IIS process (typically SYSTEM). This could lead to complete compromise of the web server [1].

Mitigation

Microsoft released a cumulative security patch in MS01-044, which addresses this vulnerability. Administrators are advised to apply the patch to all IIS 5.0 systems [1]. No workaround is documented, and the patch is the recommended mitigation.