Oval Definition:	oval:org.mitre.oval:def:6508
Revision Date: 2014-08-18 Version: 25 Title: IIS FTP Service DoS Vulnerability Description: Stack consumption vulnerability in the FTP Service in Microsoft Internet Information Services (IIS) 5.0 through 7.0 allows remote authenticated users to cause a denial of service (daemon crash) via a list (ls) -R command containing a wildcard that references a subdirectory, followed by a .. (dot dot), aka "IIS FTP Service DoS Vulnerability." Family: windows Class: vulnerability Status: ACCEPTED Reference(s): CVE-2009-2521 Platform(s): Microsoft Windows 2000 Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Vista Microsoft Windows XP Product(s): Microsoft Internet Information Server (IIS) Definition Synopsis Windows 2000 - IIS 5.0 (FTP Service 5.0) Microsoft Windows 2000 is installed AND Microsoft IIS 5.0 is installed AND The version of ftpsvc2.dll is less than 5.0.2195.7336 OR Windows XP x86 - IIS 5.1 (FTP Service 5.1) Microsoft Windows XP (32-bit) is installed AND Microsoft IIS 5.1 is installed AND The version of ftpsvc2.dll is less than 6.0.2600.3624 OR Windows XP x86 - IIS 5.1 (FTP Service 5.1) Microsoft Windows XP (32-bit) is installed AND Microsoft IIS 5.1 is installed AND The version of ftpsvc2.dll is less than 6.0.2600.5875 OR Windows XP x64/Windows 2003 (x86/x64/ia64) - IIS 6.0 (FTP Service 6.0) Windows XP x64/Windows 2003 (x86/x64/ia64) Microsoft Windows XP x64 is installed OR Microsoft Windows Server 2003 (32-bit) is installed OR Microsoft Windows Server 2003 (x64) is installed OR Microsoft Windows Server 2003 (ia64) Gold is installed AND Microsoft IIS 6.0 is installed AND The version of ftpsvc2.dll is less than 6.0.3790.4584 OR Windows Vista x86/x64 - IIS 7.0 (FTP Service 6.0) Windows Vista x86/x64 Microsoft Windows Vista (32-bit) is installed OR Microsoft Windows Vista x64 Edition is installed AND Microsoft IIS 7.0 is installed AND the version of ftpsvc2.dll is greater than or equal 7.0.6000.16000 AND The version of ftpsvc2.dll is less than 7.0.6000.16923 OR Windows Vista x86/x64 - IIS 7.0 (FTP Service 6.0) Windows Vista x86/x64 Microsoft Windows Vista (32-bit) is installed OR Microsoft Windows Vista x64 Edition is installed AND Microsoft IIS 7.0 is installed AND the version of ftpsvc2.dll is greater than or equal 7.0.6000.20000 AND The version of ftpsvc2.dll is less than 7.0.6000.21123 OR Windows Vista x86/x64, Windows Server 2008 x86/x64/ia64 - IIS 7.0 (FTP Service 6.0) Windows Vista x86/x64, Windows Server 2008 x86/x64/ia64 Microsoft Windows Vista (32-bit) is installed OR Microsoft Windows Vista x64 Edition is installed OR Microsoft Windows Server 2008 (32-bit) is installed OR Microsoft Windows Server 2008 (64-bit) is installed OR Microsoft Windows Server 2008 (ia-64) is installed AND Microsoft IIS 7.0 is installed AND GDR or LDR Service branch The version of ftpsvc2.dll is less than 7.0.6001.18327 OR LDR the version of ftpsvc2.dll is greater than or equal 7.0.6001.22000 AND The version of ftpsvc2.dll is less than 7.0.6001.22516 OR Windows Vista x86/x64, Windows Server 2008 x86/x64/ia64 - IIS 7.0 (FTP Service 6.0) Windows Vista x86/x64, Windows Server 2008 x86/x64/ia64 Microsoft Windows Vista (32-bit) is installed OR Microsoft Windows Vista x64 Edition is installed OR Microsoft Windows Server 2008 (32-bit) is installed OR Microsoft Windows Server 2008 (64-bit) is installed OR Microsoft Windows Server 2008 (ia-64) is installed AND Microsoft IIS 7.0 is installed AND GDR or LDR Service branch The version of ftpsvc2.dll is less than 7.0.6002.18107 OR LDR the version of ftpsvc2.dll is greater than or equal 7.0.6002.22000 AND The version of ftpsvc2.dll is less than 7.0.6002.22219
BACK