Vulnerability record · CVE-2002-0073 · published 22 April 2002
CVE-2002-0073: Microsoft IIS FTP service denial of service via crafted glob status request
Microsoft · Internet Information Server
The FTP service in Microsoft IIS 4.0, 5.0 and 5.1 can be crashed by a specially crafted status request containing glob characters. An attacker only needs an established FTP session, so the barrier to triggering the flaw is low. The result is a denial of service against the FTP service on the affected host.
Description
The FTP service in Internet Information Server (IIS) 4.0, 5.0 and 5.1 allows attackers who have established an FTP session to cause a denial of service via a specially crafted status request containing glob characters.
AV:N/AC:L/Au:N/C:N/I:N/A:P
Automated analysis
medium priorityThe flaw is a remotely reachable denial of service with a low-complexity vector, but it only degrades availability and affects legacy, unsupported IIS versions.
What it is
The FTP service in Microsoft IIS 4.0, 5.0 and 5.1 can be crashed by a specially crafted status request containing glob characters. An attacker only needs an established FTP session, so the barrier to triggering the flaw is low. The result is a denial of service against the FTP service on the affected host.
Impact
An attacker can cause the IIS FTP service to become unavailable, disrupting file transfer operations for legitimate users. The flaw does not provide code execution, data disclosure or integrity impact based on the CVSS vector.
Attack surface
Reached over the network through the FTP service; the attacker must first establish an FTP session, which may require valid credentials or anonymous access depending on server configuration. No user interaction is needed on the victim side.
Exploitation
Not listed in CISA KEV and no ransomware association is documented. EPSS is high (0.56391, 99th percentile), but the references carry no exploit tags, so public exploit availability is not confirmed by this record.
What to do
- Apply the Microsoft security bulletin MS02-018 update for IIS, which addresses this FTP flaw.
- Disable or restrict the IIS FTP service on hosts that do not require it.
- Require authentication for FTP and disable anonymous access where feasible.
- Segment or firewall FTP access so only trusted networks can reach the service.
- Monitor vendor advisories for IIS 4.0/5.0/5.1, which are long out of support, and plan migration to a supported platform.
Detection
- Monitor IIS FTP logs for repeated abnormal status requests containing glob characters such as asterisks or question marks.
- Alert on FTP service crashes, unexpected restarts or gaps in FTP logging.
- Correlate multiple FTP sessions from a single source with malformed or unusual command sequences.
- Use OVAL definitions referenced for this CVE to check host patch state.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2002-0073 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2002-0073), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
