| Vulnerability Name: | CVE-2006-0026 (CCN-26796) | ||||||||
| Assigned: | 2005-11-30 | ||||||||
| Published: | 2006-07-11 | ||||||||
| Updated: | 2020-11-23 | ||||||||
| Summary: | Buffer overflow in Microsoft Internet Information Services (IIS) 5.0, 5.1, and 6.0 allows local and possibly remote attackers to execute arbitrary code via crafted Active Server Pages (ASP). | ||||||||
| CVSS v3 Severity: | 5.5 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L)
| ||||||||
| CVSS v2 Severity: | 6.5 Medium (CVSS v2 Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P) 4.8 Medium (Temporal CVSS v2 Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P/E:U/RL:OF/RC:C)
4.8 Medium (CCN Temporal CVSS v2 Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P/E:U/RL:OF/RC:C)
| ||||||||
| Vulnerability Type: | CWE-Other | ||||||||
| Vulnerability Consequences: | Gain Access | ||||||||
| References: | Source: BUGTRAQ Type: UNKNOWN 20060718 ASP.DLL Include File Buffer Overflow Source: MITRE Type: CNA CVE-2006-0026 Source: CCN Type: SA21006 Microsoft Internet Information Services ASP Code Buffer Overflow Source: SECUNIA Type: Patch, Vendor Advisory 21006 Source: CCN Type: SECTRACK ID: 1016466 Microsoft Internet Information Server (IIS) Buffer Overflow in Processing ASP Pages Lets Remote Authenticated Users Execute Arbitrary Code Source: SECTRACK Type: Patch 1016466 Source: CCN Type: ASA-2006-135 Windows Security Updates for July 2006 - (MS06-033 - MS06-039) Source: CCN Type: US-CERT VU#395588 Microsoft Internet Information Services vulnerable to remote code execution via specially crafted ASP file Source: CERT-VN Type: Patch, US Government Resource VU#395588 Source: CCN Type: Microsoft Security Bulletin MS06-034 Vulnerability in Microsoft Internet Information Services using Active Server Pages Could Lead To Remote Code Execution (917537) Source: CCN Type: Microsoft Security Bulletin MS08-006 Vulnerability in Internet Information Services Could Allow Remote Code Execution (942830) Source: CCN Type: Microsoft Security Bulletin MS10-065 Vulnerabilities in Microsoft Internet Information Services (IIS) Could Allow Remote Code Execution (2267960) Source: OSVDB Type: UNKNOWN 27152 Source: CCN Type: OSVDB ID: 27152 Microsoft Windows IIS ASP Page Processing Overflow Source: BID Type: Patch 18858 Source: CCN Type: BID-18858 Microsoft IIS ASP Remote Code Execution Vulnerability Source: CERT Type: US Government Resource TA06-192A Source: VUPEN Type: UNKNOWN ADV-2006-2752 Source: MS Type: UNKNOWN MS06-034 Source: XF Type: UNKNOWN iis-asp-bo(26796) Source: XF Type: UNKNOWN iis-asp-bo(26796) Source: OVAL Type: UNKNOWN oval:org.mitre.oval:def:435 | ||||||||
| Vulnerable Configuration: | Configuration 1: Configuration CCN 1:  Denotes that component is vulnerable | ||||||||
| Oval Definitions | |||||||||
| |||||||||
| BACK | |||||||||