CVE-2002-0150

Think of this like a security guard at a building entrance who is supposed to check the length of every delivery before letting it in, but a cleverly oversized package can trick the guard and get through anyway. Once inside, it can jam the doors (crash the server) or, in the worst case, let an intruder roam freely (run their own commands on the server).

This matters to you only if some part of your business still runs a website or internal application on Microsoft Internet Information Services (IIS) version 4.0, 5.0, or 5.1 — these are extremely old versions from the Windows NT 4.0/2000/XP era. It is a real risk only if that server is reachable from the internet; if it's long retired or only on an isolated internal network, this does not apply to you.

No one has reported this being exploited in the wild, and there's no public attack tool available, so this is not an active emergency. However, because no fix exists and these IIS versions are no longer supported, any exposed server should be checked and isolated or migrated soon rather than left running indefinitely.

Confirm exposure by inventorying all internet-facing (and internal) web servers for IIS version 4.0, 5.0, or 5.1 — check IIS version via server banner, IIS Manager, or registry (HKLM\SOFTWARE\Microsoft\InetStp\VersionString). No vendor patch is recorded for this CVE in the available findings; these IIS versions are end-of-life and Microsoft is unlikely to issue further fixes. Remediation path: migrate affected sites/applications to a currently supported IIS version (10.0 on Windows Server 2016+) or an alternative modern web server, then decommission the legacy OS/IIS instance. As an interim workaround if migration cannot happen immediately: place the server behind a reverse proxy or WAF that strips/normalizes oversized or malformed HTTP header values, restrict inbound access via firewall/ACL to known trusted IPs, and disable any unused IIS features/extensions. Not in CISA KEV, so there is no federal remediation deadline. Monitor for unusual crashes/restarts of the IIS service and for anomalous HTTP header lengths in web logs as early indicators of exploitation attempts.

CVSS 7.5 (High) — AV:N/AC:L/Au:N/C:P/I:P/A:P indicates remote, low-complexity, unauthenticated exploitation with partial impact to confidentiality, integrity, and availability. Weakness type is an unspecified buffer overflow (CWE-Other) triggered by crafted HTTP header field values that bypass a length/safety validation check, enabling denial of service or potentially arbitrary code execution. Not listed in CISA's Known Exploited Vulnerabilities catalog, and no public exploit code has been identified. EPSS places predicted exploitation likelihood in a very high percentile relative to all scored CVEs, though the trend is currently falling, and press attention is rising despite no confirmed in-the-wild activity. No patch/fix information is available in current records; given the age and end-of-life status of IIS 4.0/5.0/5.1, remediation should be treated as architectural (replacement) rather than patch-based.