Vulnerability record · CVE-2002-0149 · published 22 April 2002
CVE-2002-0149: Microsoft IIS ASP Server-Side Include buffer overflow
Microsoft · Internet Information Server
A buffer overflow exists in the ASP Server-Side Include function in Microsoft IIS 4.0, 5.0 and 5.1, triggered by long file names. A remote, unauthenticated attacker can crash the service and possibly execute arbitrary code on the server.
Description
Buffer overflow in ASP Server-Side Include Function in IIS 4.0, 5.0 and 5.1 allows remote attackers to cause a denial of service and possibly execute arbitrary code via long file names.
AV:N/AC:L/Au:N/C:P/I:P/A:P
Automated analysis
high priorityRemote unauthenticated buffer overflow with possible code execution and a very high EPSS percentile, though the affected IIS versions are legacy and no KEV listing exists.
What it is
A buffer overflow exists in the ASP Server-Side Include function in Microsoft IIS 4.0, 5.0 and 5.1, triggered by long file names. A remote, unauthenticated attacker can crash the service and possibly execute arbitrary code on the server.
Impact
An attacker can cause a denial of service against the web server and potentially execute arbitrary code in the IIS process context, which typically runs with high privileges.
Attack surface
Reachable over the network via HTTP requests to an IIS server processing ASP Server-Side Include directives; no authentication or user interaction is required per the CVSS vector AV:N/AC:L/Au:N.
Exploitation
Not listed in CISA KEV and no ransomware associations are recorded, but EPSS is high at roughly 0.627 (99th percentile), indicating elevated likelihood of attempted exploitation; no public exploit code is confirmed in the supplied references.
What to do
- Apply Microsoft security bulletin MS02-018 for IIS 4.0, 5.0 and 5.1, or upgrade to a supported IIS version.
- Disable or restrict ASP Server-Side Include processing where it is not required.
- Limit untrusted input to file name parameters handled by SSI directives.
- Segment and firewall IIS hosts so only necessary clients can reach the web service.
- Monitor vendor and CERT/CC advisories for updated guidance.
Detection
- Inspect IIS and HTTP logs for requests containing abnormally long file names or SSI directive paths.
- Alert on IIS worker process crashes or unexpected restarts (W3WP/inetinfo) correlated with web requests.
- Use the OVAL definitions referenced for this CVE to check host patch state.
- Monitor for post-exploitation behavior such as unexpected child processes spawned by IIS.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2002-0149 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2002-0149), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
