Vulnerability record · CVE-2001-0500 · published 21 July 2001
CVE-2001-0500: Microsoft IIS Index Server ISAPI idq.dll buffer overflow
Microsoft · Index Server
A buffer overflow in the ISAPI extension idq.dll, used by Index Server 2.0 and Indexing Service 2000 in IIS 6.0 beta and earlier, is triggered by a long argument passed to Internet Data Administration (.ida) and Internet Data Query (.idq) files such as default.ida. The flaw is remotely reachable and unauthenticated, and it is the vulnerability exploited by the Code Red worm.
Description
Buffer overflow in ISAPI extension (idq.dll) in Index Server 2.0 and Indexing Service 2000 in IIS 6.0 beta and earlier allows remote attackers to execute arbitrary commands via a long argument to Internet Data Administration (.ida) and Internet Data Query (.idq) files such as default.ida, as commonly exploited by Code Red.
AV:N/AC:L/Au:N/C:C/I:C/A:C
Automated analysis
critical priorityUnauthenticated remote code execution with a 10.0 CVSS score, public exploit code and near-maximum EPSS probability make this an urgent exposure wherever affected IIS/Index Server hosts remain reachable.
What it is
A buffer overflow in the ISAPI extension idq.dll, used by Index Server 2.0 and Indexing Service 2000 in IIS 6.0 beta and earlier, is triggered by a long argument passed to Internet Data Administration (.ida) and Internet Data Query (.idq) files such as default.ida. The flaw is remotely reachable and unauthenticated, and it is the vulnerability exploited by the Code Red worm.
Impact
An attacker can execute arbitrary commands with the privileges of the IIS/Index Server process, giving full control of the host. The CVSS 2.0 vector rates complete confidentiality, integrity and availability impact.
Attack surface
Reached over the network via HTTP requests to .ida or .idq endpoints handled by idq.dll; the vector AV:N/AC:L/Au:N indicates no authentication and no user interaction are required.
Exploitation
The record is not listed in CISA KEV, but EPSS is very high (0.96671, 99.882 percentile) and CERT advisory CA-2001-13 is tagged Exploit, indicating public exploit code and active mass exploitation via Code Red.
What to do
- Apply Microsoft security bulletin MS01-033 to patch idq.dll and the affected Index Server/Indexing Service components.
- Remove or unmap the .ida and .idq ISAPI script mappings if Index Server functionality is not required.
- Disable the Index Server and Indexing Service where they are not needed.
- Filter or block HTTP requests for .ida and .idq files at the web server or perimeter.
- Verify no vulnerable IIS 6.0 beta or earlier hosts remain exposed to untrusted networks.
Detection
- Search web server logs for requests to default.ida or other .ida/.idq paths, especially with long query strings.
- Monitor for unusual child processes spawned by IIS or the Index Server process (dllhost.exe, inetinfo.exe).
- Alert on repeated or oversized requests to .ida/.idq endpoints from single or many sources.
- Check hosts for known Code Red artifacts such as root.exe or unusual files in web directories.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
3 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2001-0500 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2001-0500), CISA KEV, FIRST EPSS (scores of 2026-09-25). This page is refreshed as NVD updates the record.
