CVE-2002-1182

Vulnerability

A denial of service vulnerability exists in Microsoft Internet Information Services (IIS) 5.0 and 5.1 due to a flaw in how the server allocates memory for WebDAV requests [1]. When a specially malformed WebDAV request is sent, the server assigns a large amount of memory, eventually exhausting resources and causing the service to crash. This affects IIS 5.0 and 5.1 on Windows 2000 and Windows XP.

Exploitation

An attacker can exploit this vulnerability remotely without authentication by sending a crafted WebDAV request to the target IIS server [1]. No special network position is required beyond network access to the server. The attacker simply sends the malformed request, which triggers the memory allocation flaw.

Impact

Successful exploitation results in a denial of service: the IIS service crashes, disrupting web services hosted on the server [1]. The crash is temporary; the service can be restarted. No code execution or data compromise is achieved; the impact is limited to availability.

Mitigation

Microsoft released a cumulative security patch (MS02-062) that addresses this vulnerability for IIS 4.0, 5.0, and 5.1 [1]. The patch was published on October 23, 2002. Administrators should apply the patch to affected systems. No workarounds are documented in the reference.