Vulnerability Name:

CVE-2002-0371 (CCN-9247)

Assigned:2002-06-04
Published:2002-06-04
Updated:2021-07-23
Summary:Buffer overflow in gopher client for Microsoft Internet Explorer 5.1 through 6.0, Proxy Server 2.0, or ISA Server 2000 allows remote attackers to execute arbitrary code via a gopher:// URL that redirects the user to a real or simulated gopher server that sends a long response.
CVSS v3 Severity:7.3 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): Low
Integrity (I): Low
Availibility (A): Low
CVSS v2 Severity:7.5 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
7.5 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
Vulnerability Type:CWE-Other
Vulnerability Consequences:Gain Access
References:Source: CCN
Type: BugTraq Mailing List, Tue Jun 04 2002 - 08:07:34 CDT
Buffer overflow in MSIE gopher code

Source: MITRE
Type: CNA
CVE-2002-0371

Source: BUGTRAQ
Type: UNKNOWN
20020604 Buffer overflow in MSIE gopher code

Source: BUGTRAQ
Type: UNKNOWN
20020613 Microsoft releases critical fix that breaks their own software!

Source: BUGTRAQ
Type: UNKNOWN
20020613 Flawed workaround in MS02-027 -- gopher can run on _any_ port, not just 70

Source: CCN
Type: Microsoft Product Support Services
List of Fixes in Microsoft Internet Explorer 6 SP1

Source: CCN
Type: CIAC Information Bulletin M-088
MS Unchecked Buffer in Gopher Protocol Handler

Source: CCN
Type: CIAC Information Bulletin M-116
Microsoft Cumulative Patch for Internet Explorer

Source: XF
Type: UNKNOWN
ie-gopher-bo(9247)

Source: CCN
Type: US-CERT VU#440275
Microsoft Internet Explorer contains buffer overflow in handling of gopher replies

Source: CERT-VN
Type: US Government Resource
VU#440275

Source: CCN
Type: Microsoft Security Bulletin MS02-027
Unchecked Buffer in Gopher Protocol Handler Can Run Code of Attacker's Choice (Q323889)

Source: CCN
Type: Microsoft Security Bulletin MS02-047
Cumulative Patch for Internet Explorer (Q323759)

Source: CCN
Type: Microsoft Security Bulletin MS02-066
Cumulative Patch for Internet Explorer (Q328970)

Source: CCN
Type: Microsoft Security Bulletin MS02-068
Cumulative Patch for Internet Explorer (324929)

Source: CCN
Type: Microsoft Security Bulletin MS03-004
Cumulative Patch for Internet Explorer (810847)

Source: CCN
Type: Microsoft Security Bulletin MS03-015
Cumulative Patch for Internet Explorer (813489)

Source: CCN
Type: Microsoft Security Bulletin MS03-020
Cumulative Patch for Internet Explorer (818529)

Source: CCN
Type: Microsoft Security Bulletin MS03-032
Cumulative Patch for Internet Explorer (822925)

Source: CCN
Type: Microsoft Security Bulletin MS03-040
Cumulative Patch for Internet Explorer (828750)

Source: CCN
Type: Microsoft Security Bulletin MS03-048
Cumulative Security Update for Internet Explorer (824145)

Source: CCN
Type: Microsoft Security Bulletin MS04-004
Cumulative Security Update for Internet Explorer (832894)

Source: CCN
Type: Microsoft Security Bulletin MS04-025
Cumulative Security Update for Internet Explorer (867801)

Source: CCN
Type: Microsoft Security Bulletin MS04-038
Cumulative Security Update for Internet Explorer (834707)

Source: CCN
Type: Microsoft Security Bulletin MS04-040
Cumulative Security Update for Internet Explorer (889293)

Source: CCN
Type: Microsoft Security Bulletin MS05-014
Cumulative Security Update for Internet Explorer (867282)

Source: CCN
Type: Microsoft Security Bulletin MS05-020
Cumulative Security Update for Internet Explorer (890923)

Source: CCN
Type: Microsoft Security Bulletin MS05-025
Cumulative Security Update for Internet Explorer (883939)

Source: CCN
Type: Microsoft Security Bulletin MS05-038
Cumulative Security Update for Internet Explorer (896727)

Source: CCN
Type: Microsoft Security Bulletin MS05-052
Cumulative Security Update for Internet Explorer (896688)

Source: CCN
Type: Microsoft Security Bulletin MS05-054
Cumulative Security Update for Internet Explorer (905915)

Source: CCN
Type: Microsoft Security Bulletin MS06-004
Cumulative Security Update for Internet Explorer (910620)

Source: CCN
Type: Microsoft Security Bulletin MS06-013
Cumulative Security Update for Internet Explorer (912812)

Source: CCN
Type: Microsoft Security Bulletin MS06-021
Cumulative Security Update for Internet Explorer (916281)

Source: CCN
Type: Microsoft Security Bulletin MS06-042
Cumulative Security Update for Internet Explorer (918899)

Source: CCN
Type: Microsoft Security Bulletin MS06-067
Cumulative Security Update for Internet Explorer (922760)

Source: CCN
Type: Microsoft Security Bulletin MS06-072
Cumulative Security Update for Internet Explorer (925454)

Source: CCN
Type: Microsoft Security Bulletin MS07-016
Cumulative Security Update for Internet Explorer (928090)

Source: CCN
Type: Microsoft Security Bulletin MS07-027
Cumulative Security Update for Internet Explorer (931768)

Source: CCN
Type: Microsoft Security Bulletin MS07-033
Cumulative Security Update for Internet Explorer (933566)

Source: CCN
Type: Microsoft Security Bulletin MS07-045
Cumulative Security Update for Internet Explorer (937143)

Source: CCN
Type: Microsoft Security Bulletin MS07-057
Cumulative Security Update for Internet Explorer (939653)

Source: CCN
Type: Microsoft Security Bulletin MS07-069
Cumulative Security Update for Internet Explorer (942615)

Source: CCN
Type: Microsoft Security Bulletin MS08-010
Cumulative Security Update for Internet Explorer (944533)

Source: CCN
Type: Microsoft Security Bulletin MS08-024
Cumulative Security Update for Internet Explorer (947864)

Source: CCN
Type: Microsoft Security Bulletin MS08-031
Cumulative Security Update for Internet Explorer (950759)

Source: CCN
Type: Microsoft Security Bulletin MS08-045
Cumulative Security Update for Internet Explorer (953838)

Source: CCN
Type: Microsoft Security Bulletin MS08-058
Cumulative Security Update for Internet Explorer (956390)

Source: CCN
Type: OSVDB ID: 3004
Microsoft IE Gopher Client Overflow

Source: MISC
Type: UNKNOWN
http://www.pivx.com/workaround_fail.html

Source: BID
Type: UNKNOWN
4930

Source: CCN
Type: BID-4930
Multiple Microsoft Product Gopher Client Buffer Overflow Vulnerability

Source: MS
Type: UNKNOWN
MS02-027

Source: XF
Type: UNKNOWN
ie-gopher-bo(9247)

Source: OVAL
Type: UNKNOWN
oval:org.mitre.oval:def:98

Source: CCN
Type: Microsoft Knowledge Base Article 328548
How to Obtain the Latest Service Pack for Internet Explorer 6

Vulnerable Configuration:Configuration 1:
  • cpe:/a:microsoft:internet_explorer:6.0:*:*:*:*:*:*:*
  • OR cpe:/a:microsoft:isa_server:2000:*:*:*:*:*:*:*
  • OR cpe:/a:microsoft:internet_explorer:5.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:microsoft:internet_explorer:5.0.1:sp1:*:*:*:*:*:*
  • OR cpe:/a:microsoft:isa_server:2000:sp1:*:*:*:*:*:*
  • OR cpe:/a:microsoft:proxy_server:2.0:*:*:*:*:*:*:*
  • OR cpe:/a:microsoft:internet_explorer:5.0.1:sp2:*:*:*:*:*:*
  • OR cpe:/a:microsoft:internet_explorer:5.5:*:*:*:*:*:*:*
  • OR cpe:/a:microsoft:proxy_server:2.0:sp1:*:*:*:*:*:*
  • OR cpe:/a:university_of_minnesota:gopher:*:*:*:*:*:*:*:*
  • OR cpe:/a:microsoft:internet_explorer:5.5:sp1:*:*:*:*:*:*
  • OR cpe:/a:microsoft:internet_explorer:5.5:sp2:*:*:*:*:*:*

  • Configuration CCN 1:
  • cpe:/a:microsoft:proxy_server:2.0:*:*:*:*:*:*:*
  • OR cpe:/a:microsoft:internet_explorer:5.01:*:*:*:*:*:*:*
  • OR cpe:/a:microsoft:internet_explorer:5.5:-:*:*:*:*:*:*
  • OR cpe:/a:microsoft:isa_server:2000:*:*:*:*:*:*:*
  • OR cpe:/a:microsoft:internet_explorer:6.0:*:*:*:*:*:*:*

  • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.mitre.oval:def:98
    V
    Gopher Client Buffer Overflow
    2014-02-24
    BACK
    microsoft internet explorer 6.0
    microsoft isa server 2000
    microsoft internet explorer 5.0.1
    microsoft internet explorer 5.0.1 sp1
    microsoft isa server 2000 sp1
    microsoft proxy server 2.0
    microsoft internet explorer 5.0.1 sp2
    microsoft internet explorer 5.5
    microsoft proxy server 2.0 sp1
    university_of_minnesota gopher *
    microsoft internet explorer 5.5 sp1
    microsoft internet explorer 5.5 sp2
    microsoft proxy server 2.0
    microsoft ie 5.01
    microsoft ie 5.5
    microsoft isa server 2000
    microsoft ie 6.0