Jonathan Afek

The issue is related to a buffer overflow in the MLF application, which can be exploited by remote attackers to execute arbitrary commands or cause a denial of service, resulting in a system crash. The exact vectors used for the exploitation are not specified.

The issue allows remote attackers to cause a denial of service, resulting in a system crash, via unknown vectors.

The issue allows remote attackers to cause a denial of service, resulting in a system crash, via unknown vectors.

The issue allows remote attackers to cause a denial of service, resulting in a system crash, via unknown vectors.

The issue allows remote authenticated users to gain privileges via unknown vectors.

The issue concerns the URL parser in Microsoft Internet Information Services (IIS) 5.1, allowing remote attackers to execute arbitrary code. This is achieved through multiple requests to ".dll" followed by specific arguments, such as `~0` through `~9`, which causes ntdll.dll to produce a return value that IIS does not handle correctly. An example of such a request is "/ vti bin/.dll/*/~0". Initially, it was believed that the consequence of this issue would only be a denial of service, resulting in an application crash and reboot.