Vulnerability record · CVE-2002-0150 · published 22 April 2002
CVE-2002-0150: Microsoft IIS HTTP header buffer overflow allows code execution
Microsoft · Internet Information Server
A buffer overflow in Microsoft Internet Information Server (IIS) 4.0, 5.0, and 5.1 is triggered by crafted HTTP header field values. The flaw lets a remote attacker bypass the HTTP header safety check, causing a denial of service or potentially executing arbitrary code. It matters because IIS was widely deployed as an internet-facing web server, making this remotely reachable without credentials.
Description
Buffer overflow in Internet Information Server (IIS) 4.0, 5.0, and 5.1 allows remote attackers to spoof the safety check for HTTP headers and cause a denial of service or execute arbitrary code via HTTP header field values.
AV:N/AC:L/Au:N/C:P/I:P/A:P
Automated analysis
high priorityRemote unauthenticated code execution and DoS on a widely deployed web server, with high EPSS despite no KEV listing.
What it is
A buffer overflow in Microsoft Internet Information Server (IIS) 4.0, 5.0, and 5.1 is triggered by crafted HTTP header field values. The flaw lets a remote attacker bypass the HTTP header safety check, causing a denial of service or potentially executing arbitrary code. It matters because IIS was widely deployed as an internet-facing web server, making this remotely reachable without credentials.
Impact
An unauthenticated remote attacker can crash the IIS service or, depending on the overflow, execute arbitrary code in the web server's context. Successful code execution would give the attacker the privileges of the IIS process on the host.
Attack surface
Reached over the network by sending HTTP requests with malicious header field values to an affected IIS server; no authentication or user interaction is required per the AV:N/AC:L/Au:N vector. The description does not specify which header fields or exact request shape.
Exploitation
Not listed in CISA KEV and no ransomware associations are recorded, but EPSS is high at roughly 0.49 (98.8th percentile), indicating elevated predicted exploitation activity. Reference tags are limited to US Government Resource and general advisories, with no public exploit tag supplied.
What to do
- Apply the Microsoft security bulletin MS02-018 update for IIS 4.0, 5.0, and 5.1 as the primary fix.
- If patching is not immediately possible, disable or restrict unnecessary IIS services and reduce internet exposure of affected servers.
- Deploy a reverse proxy or WAF to inspect and reject malformed or oversized HTTP header values before they reach IIS.
- Monitor vendor and CERT/CC advisories for updated guidance and confirm affected versions against the bulletin.
- Retire or isolate end-of-life IIS versions that can no longer be patched.
Detection
- Inspect IIS and web server logs for requests containing unusually long or malformed HTTP header field values.
- Alert on IIS worker process crashes, unexpected service restarts, or w3wp.exe faults correlated with inbound HTTP traffic.
- Monitor for post-exploitation behavior such as unexpected child processes spawned by the IIS process or new listening services.
- Use network IDS signatures for known IIS header overflow patterns where available.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2002-0150 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2002-0150), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
