CVE-2001-0500 EXPLOIT
10.0
HIGH · CVSS 2.0 · EPSS 96.7% (pctl 100)
Patch early
A public exploit exists.
Description
Buffer overflow in ISAPI extension (idq.dll) in Index Server 2.0 and Indexing Service 2000 in IIS 6.0 beta and earlier allows remote attackers to execute arbitrary commands via a long argument to Internet Data Administration (.ida) and Internet Data Query (.idq) files such as default.ida, as commonly exploited by Code Red.
Scoring
| CVSS | 10.0 (HIGH, v2.0) |
|---|---|
| Vector | AV:N/AC:L/Au:N/C:C/I:C/A:C |
| EPSS | 96.67% — more likely to be exploited than 100% of all CVEs |
| On CISA KEV | no |
| Public exploit | yes |
| Published | 2001-07-21 |
| Last modified | 2026-06-16 |
Affected (3)
| Vendor | Product |
|---|---|
| microsoft | index server |
| microsoft | indexing service |
| microsoft | internet information server |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | Microsoft IIS 5.0 - IDQ Path Overflow (MS01-033) (Metasploit) | 2010-06-15 |
| exploit-db | Microsoft Index Server 2.0 / Indexing Service (Windows 2000) - ISAPI Extension Buffer Overflow (2) | 2001-06-21 |
| exploit-db | Microsoft Index Server 2.0 / Indexing Service (Windows 2000) - ISAPI Extension Buffer Overflow (PoC) | 2001-06-18 |
| exploit-db | Microsoft Index Server 2.0 / Indexing Service (Windows 2000) - ISAPI Extension Buffer Overflow (3) | 2001-06-18 |
| exploit-db | Microsoft Index Server 2.0 / Indexing Service (Windows 2000) - ISAPI Extension Buffer Overflow (4) | 2001-06-18 |
References
- http://www.cert.org/advisories/CA-2001-13.html
- http://www.ciac.org/ciac/bulletins/l-098.shtml
- http://www.iss.net/security_center/static/6705.php
- http://www.securityfocus.com/archive/1/191873
- http://www.securityfocus.com/bid/2880
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2001/ms01-033
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A197
- http://www.cert.org/advisories/CA-2001-13.html
- http://www.ciac.org/ciac/bulletins/l-098.shtml
- http://www.iss.net/security_center/static/6705.php
- http://www.securityfocus.com/archive/1/191873
- http://www.securityfocus.com/bid/2880
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2001/ms01-033
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A197
→ the Explorer · watch your stack · NVD