Vulnerability record · CVE-2005-4360 · published 20 December 2005
CVE-2005-4360: Microsoft IIS URL parser unchecked return value enables remote code execution
Microsoft · Internet Information Services
The URL parser in Microsoft IIS 5.1 on Windows XP Professional SP2 mishandles a return value from ntdll.dll when a request targets a ".dll" path followed by arguments such as "~0" through "~9", as in "/_vti_bin/.dll/*/~0". The flaw was initially believed to cause only a denial of service (crash and reboot), but the record states it can lead to remote arbitrary code execution. It matters because IIS 5.1 is remotely reachable and the request needs no credentials.
Description
The URL parser in Microsoft Internet Information Services (IIS) 5.1 on Windows XP Professional SP2 allows remote attackers to execute arbitrary code via multiple requests to ".dll" followed by arguments such as "~0" through "~9", which causes ntdll.dll to produce a return value that is not correctly handled by IIS, as demonstrated using "/_vti_bin/.dll/*/~0". NOTE: the consequence was originally believed to be only a denial of service (application crash and reboot).
AV:N/AC:L/Au:N/C:N/I:C/A:N
Automated analysis
high priorityRemote, unauthenticated code execution with public exploit references and a very high EPSS score, though the affected platform is legacy and the patch is available.
What it is
The URL parser in Microsoft IIS 5.1 on Windows XP Professional SP2 mishandles a return value from ntdll.dll when a request targets a ".dll" path followed by arguments such as "~0" through "~9", as in "/_vti_bin/.dll/*/~0". The flaw was initially believed to cause only a denial of service (crash and reboot), but the record states it can lead to remote arbitrary code execution. It matters because IIS 5.1 is remotely reachable and the request needs no credentials.
Impact
A remote attacker can execute arbitrary code in the context of the IIS service, or at minimum crash the service and reboot the host. Successful code execution would give the attacker a foothold on the web server.
Attack surface
Reached over the network through HTTP requests to the IIS web server; the CVSS vector (AV:N/AC:L/Au:N) indicates no authentication and low complexity. No user interaction is described.
Exploitation
Not listed in CISA KEV, but EPSS is very high (0.86729, 99.7th percentile) and multiple references are tagged Exploit, indicating public exploit material exists. No ransomware group is documented as using it.
What to do
- Apply the Microsoft security update MS07-041 (referenced as the patch) to IIS 5.1.
- If the patch cannot be applied, disable or block access to the /_vti_bin/ path and other FrontPage Server Extensions endpoints.
- Upgrade or migrate off IIS 5.1 on Windows XP Professional SP2, which is long out of support.
- Filter inbound HTTP requests containing ".dll" path segments followed by "~0" through "~9" at a reverse proxy or WAF.
- Restrict network exposure of the IIS host to trusted clients only.
Detection
- Search web server logs for requests containing ".dll" followed by "~0" through "~9", especially under /_vti_bin/.
- Alert on IIS worker process crashes or unexpected host reboots correlated with inbound HTTP traffic.
- Monitor for unusual child processes or network connections spawned by the IIS service account.
- Review WAF and proxy logs for repeated malformed .dll URL patterns from single sources.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2005-4360 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2005-4360), CISA KEV, FIRST EPSS (scores of 2026-09-24). This page is refreshed as NVD updates the record.
