Vulnerability record · CVE-1999-0874 · published 16 June 1999
CVE-1999-0874: IIS 4.0 buffer overflow via malformed .HTR, .IDC, .STM requests
Microsoft · Internet Information Server
IIS 4.0 contains a memory buffer overflow reachable through malformed requests for files with .HTR, .IDC, or .STM extensions. The record describes the outcome as a denial of service, though the CVSS 2.0 vector claims full confidentiality, integrity, and availability impact, so the true worst case may exceed a simple crash. It matters because IIS 4.0 shipped with Windows NT 4.0 Option Pack and Windows 2000-era deployments, and the flaw is remotely reachable without credentials.
Description
Buffer overflow in IIS 4.0 allows remote attackers to cause a denial of service via a malformed request for files with .HTR, .IDC, or .STM extensions.
AV:N/AC:L/Au:N/C:C/I:C/A:C
Automated analysis
high priorityRemote unauthenticated buffer overflow with a CVSS 2.0 score of 10 and very high EPSS, though the record only documents denial of service and the product is long obsolete.
What it is
IIS 4.0 contains a memory buffer overflow reachable through malformed requests for files with .HTR, .IDC, or .STM extensions. The record describes the outcome as a denial of service, though the CVSS 2.0 vector claims full confidentiality, integrity, and availability impact, so the true worst case may exceed a simple crash. It matters because IIS 4.0 shipped with Windows NT 4.0 Option Pack and Windows 2000-era deployments, and the flaw is remotely reachable without credentials.
Impact
An unauthenticated remote attacker can crash or destabilize the IIS service, causing denial of service. The CVSS vector also asserts complete loss of confidentiality, integrity, and availability, but the description only documents DoS, so code execution is not confirmed by this record.
Attack surface
Reached over the network by sending a malformed HTTP request targeting a file with a .HTR, .IDC, or .STM extension; the vector is AV:N/AC:L/Au:N, so no authentication and no user interaction are required. The vulnerable code path is the ISAPI/script extension handling for those legacy file types.
Exploitation
Not listed in CISA KEV and no reference carries an exploit tag, but EPSS is 0.74651 (99.5th percentile), indicating a high modeled probability of exploitation activity. No public exploit code is confirmed by the supplied references.
What to do
- Apply the Microsoft security bulletin MS99-019 / KB Q234905 fix for IIS 4.0, or upgrade off IIS 4.0 entirely.
- Remove or unmap the .HTR, .IDC, and .STM script mappings if those legacy extensions are not required.
- Restrict external exposure of IIS 4.0 hosts and place them behind a filtering reverse proxy or WAF that rejects malformed requests to those extensions.
- Isolate any remaining IIS 4.0 systems on segmented networks with no path to sensitive data.
- Monitor vendor support status: IIS 4.0 is long end-of-life, so treat any surviving instance as unsupported and plan replacement.
Detection
- Alert on HTTP requests whose URI ends in .HTR, .IDC, or .STM with unusually long or malformed query strings or path segments.
- Monitor IIS logs and Windows event logs for repeated 500-class errors, w3wp/inetinfo crashes, or service restarts correlated with those extensions.
- Baseline normal request sizes to those extensions and flag outliers that could indicate overflow attempts.
- Watch for scanning activity enumerating legacy IIS script extensions across the estate.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
3 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-1999-0874 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-1999-0874), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.
