Vulnerability record · CVE-2001-0506 · published 20 September 2001
CVE-2001-0506: IIS ssinc.dll buffer overflow via long SSI filename
Microsoft · Internet Information Server
A buffer overflow exists in ssinc.dll, the Server-Side Includes handler in IIS 5.0 and 4.0. A long filename in an SSI directive overflows a buffer when the directory name is appended, and the flaw is described as a local privilege elevation issue. It matters because successful exploitation yields full system privileges on the affected host.
Description
Buffer overflow in ssinc.dll in IIS 5.0 and 4.0 allows local users to gain system privileges via a Server-Side Includes (SSI) directive for a long filename, which triggers the overflow when the directory name is added, aka the "SSI privilege elevation" vulnerability.
AV:L/AC:L/Au:N/C:C/I:C/A:C
Automated analysis
high priorityThe flaw gives full system compromise and has public exploit material, but it requires local access and affects only legacy IIS 4.0/5.0.
What it is
A buffer overflow exists in ssinc.dll, the Server-Side Includes handler in IIS 5.0 and 4.0. A long filename in an SSI directive overflows a buffer when the directory name is appended, and the flaw is described as a local privilege elevation issue. It matters because successful exploitation yields full system privileges on the affected host.
Impact
An attacker gains complete control of the host: the CVSS vector rates confidentiality, integrity and availability impact as complete, and the description states system privileges are obtained.
Attack surface
The CVSS vector is local (AV:L), so the attacker needs local access or code execution on the IIS server rather than a remote network path. No authentication is required (Au:N) and no user interaction is indicated.
Exploitation
CISA KEV does not list this CVE, but EPSS is high at roughly 0.69 (99th percentile), and a SecurityFocus reference is tagged Exploit, indicating public exploit material exists.
What to do
- Apply the Microsoft security bulletin MS01-044 update for IIS 4.0 and 5.0, or upgrade to a supported IIS version.
- Disable the Server-Side Includes (SSI) handler and remove the .shtml/.stm script mappings if SSI is not required.
- Restrict local interactive and service logon rights on IIS hosts to the minimum accounts needed.
- Run IIS worker processes under a low-privilege account and apply least privilege to web content directories.
Detection
- Monitor IIS and Windows event logs for unexpected process creation or privilege changes originating from inetinfo or dllhost.
- Alert on unusually long filenames or SSI directives in web server request and error logs.
- Audit local logon and interactive session activity on IIS servers for accounts that should not have host access.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2001-0506 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2001-0506), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
