CVE-2006-1364

high-risk

Published 2006-03-23

Microsoft w3wp (aka w3wp.exe) does not properly handle when the AspCompat directive is not used when referencing COM components in ASP.NET, which allows remote attackers to cause a denial of service (resource consumption or crash) by repeatedly requesting each of several documents that refer to COM components, or are restricted documents located under the ASP.NET application path.

Do I need to act?

29.5% chance of exploitation in next 30 days

EPSS score — higher than 71% of all CVEs

Not on CISA KEV list

No confirmed active exploitation reported to CISA

1 public exploit available

1601

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 7.5/10 High

NETWORK / LOW complexity

Affected Products (2)

Asp.Net

Affected Vendors

Microsoft

References (18)

Broken Link http://hackingspirits.com/vuln-rnd/w3wp-remote-dos.zip

Third Party Advisory http://lists.grok.org.uk/pipermail/full-disclosure/2006-March/044291.html

Third Party Advisory http://lists.grok.org.uk/pipermail/full-disclosure/2006-March/044292.html

Third Party Advisory http://securitytracker.com/id?1015825

Exploit http://www.securiteam.com/windowsntfocus/5KP0O0KI0Y.html

http://www.securityfocus.com/archive/1/428622/100/0/threaded

Exploit http://www.securityfocus.com/bid/17188

Third Party Advisory https://exchange.xforce.ibmcloud.com/vulnerabilities/25392

Exploit https://www.exploit-db.com/exploits/1601