Vulnerability record · CVE-2002-0079 · published 22 April 2002
CVE-2002-0079: Microsoft IIS chunked encoding buffer overflow in ASP
Microsoft · Internet Information Server
A buffer overflow exists in the chunked encoding transfer mechanism used by Active Server Pages in Microsoft IIS 4.0 and 5.0. An unauthenticated remote attacker can send crafted chunked HTTP requests to crash the service or potentially execute arbitrary code in the IIS process context.
Description
Buffer overflow in the chunked encoding transfer mechanism in Internet Information Server (IIS) 4.0 and 5.0 Active Server Pages allows attackers to cause a denial of service or execute arbitrary code.
AV:N/AC:L/Au:N/C:P/I:P/A:P
Automated analysis
high priorityUnauthenticated remote code execution and DoS potential with a very high EPSS score, though the affected IIS versions are long end-of-life and no KEV listing exists.
What it is
A buffer overflow exists in the chunked encoding transfer mechanism used by Active Server Pages in Microsoft IIS 4.0 and 5.0. An unauthenticated remote attacker can send crafted chunked HTTP requests to crash the service or potentially execute arbitrary code in the IIS process context.
Impact
Successful exploitation allows denial of service against the web server, and depending on memory layout, remote code execution with the privileges of the IIS service account.
Attack surface
Reachable over the network via HTTP requests to an IIS server hosting ASP content; the CVSS vector (AV:N/AC:L/Au:N) indicates no authentication and no user interaction are required.
Exploitation
Not listed in CISA KEV and no ransomware associations are documented, but EPSS is very high (0.773, 99.5th percentile), indicating elevated predicted exploitation activity; reference tags are limited to US Government Resource advisories.
What to do
- Apply the Microsoft security bulletin MS02-018 update for IIS 4.0 and 5.0 immediately.
- Disable or remove ASP/chunked transfer handling on systems that do not require it.
- Restrict network exposure of IIS servers to trusted clients and place them behind a reverse proxy or WAF that normalizes chunked requests.
- Retire or isolate end-of-life IIS 4.0/5.0 hosts that cannot be patched.
- Monitor vendor and CERT/CC advisories for updated guidance.
Detection
- Inspect IIS and HTTP logs for malformed or unusually large chunked transfer-encoding requests.
- Alert on IIS worker process (inetinfo.dll/w3wp) crashes or unexpected restarts.
- Monitor for anomalous child processes or outbound connections spawned by the IIS service account.
- Use network IDS signatures targeting chunked encoding buffer overflow patterns against IIS.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2002-0079 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2002-0079), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
