Vulnerability record · CVE-2002-0147 · published 22 April 2002
CVE-2002-0147: Microsoft IIS ASP data transfer buffer overflow
Microsoft · Internet Information Server
A buffer overflow exists in the ASP data transfer mechanism in Microsoft Internet Information Server (IIS) 4.0, 5.0, and 5.1. A remote attacker can trigger it to cause a denial of service or potentially execute code. It is a Microsoft-discovered variant of the Chunked Encoding buffer overrun.
Description
Buffer overflow in the ASP data transfer mechanism in Internet Information Server (IIS) 4.0, 5.0, and 5.1 allows remote attackers to cause a denial of service or execute code, aka "Microsoft-discovered variant of Chunked Encoding buffer overrun."
AV:N/AC:L/Au:N/C:P/I:P/A:P
Automated analysis
high priorityRemote unauthenticated code execution or denial of service with a high EPSS score, though no KEV listing or known ransomware use is recorded.
What it is
A buffer overflow exists in the ASP data transfer mechanism in Microsoft Internet Information Server (IIS) 4.0, 5.0, and 5.1. A remote attacker can trigger it to cause a denial of service or potentially execute code. It is a Microsoft-discovered variant of the Chunked Encoding buffer overrun.
Impact
An attacker can crash the IIS service, causing denial of service, or potentially execute arbitrary code in the context of the IIS process. Successful code execution could lead to full compromise of the web server.
Attack surface
The flaw is reachable remotely over the network via HTTP requests to the ASP data transfer mechanism. No authentication or user interaction is required, as indicated by the CVSS vector AV:N/AC:L/Au:N.
Exploitation
The record does not list this CVE in CISA KEV, and no ransomware groups are documented using it. EPSS shows a 30-day exploitation probability of 0.61761 (99.133 percentile), indicating high predicted activity, but no public exploit references are tagged in the supplied data.
What to do
- Apply the Microsoft security bulletin MS02-018 patch for IIS 4.0, 5.0, and 5.1.
- Disable or remove unnecessary ASP and chunked encoding functionality if not required.
- Restrict network access to IIS servers to trusted sources where possible.
- Monitor for vendor updates and apply any subsequent cumulative patches.
Detection
- Monitor IIS logs for malformed or unusually large chunked transfer-encoding requests.
- Watch for IIS worker process crashes or unexpected restarts.
- Use network IDS signatures for known IIS chunked encoding buffer overflow patterns.
- Audit for unexpected processes or outbound connections originating from IIS.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2002-0147 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2002-0147), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
