Servers and applications
CVE-2005-4360
The URL parser in Microsoft Internet Information Services (IIS) 5.1 on Windows XP Professional SP2 allows remote attackers to execute arbitrary code via multiple requests to ".dll" followed by arguments such as "~0" through "~9", which causes ntdll.dll to produce a return value that is not correctly handled by IIS, as demonstrated using "/_vti_bin/.dll/*/~0". NOTE: the consequence was originally…
- Severity
- High 7.8
- Published
- 20 Dec 2005
- Last changed
- 16 Jun 2026
- Added to UpHeron
- 21 Oct 2026
- Exploit chance
- 87% in the next 30 daysHigher than 99% of CVEs. EPSS by FIRST, 12 Nov 2026
- Weakness
- CWE-252
- Attack
- Over the network · No login needed
- Attacker can
- Change data
- CVSS vector
AV:N/AC:L/Au:N/C:N/I:C/A:N- Sources
- NVD
Description
The URL parser in Microsoft Internet Information Services (IIS) 5.1 on Windows XP Professional SP2 allows remote attackers to execute arbitrary code via multiple requests to ".dll" followed by arguments such as "~0" through "~9", which causes ntdll.dll to produce a return value that is not correctly handled by IIS, as demonstrated using "/_vti_bin/.dll/*/~0". NOTE: the consequence was originally believed to be only a denial of service (application crash and reboot).
Affected software
| Software | Affected versions |
|---|---|
Microsoft IISServers and applications · cpe:a:microsoft:internet_information_services |
|