CVE-2001-0500 describes a critical buffer overflow vulnerability in the ISAPI extension (idq.dll) of Microsoft Index Server 2.0 and Indexing Service 2000, including IIS 6.0 beta and earlier. This flaw allows remote attackers to execute arbitrary commands by submitting a long argument to .ida and .idq files, famously exploited by the Code Red worm. With a CVSS score of 10.0 (HIGH), it represents a severe risk due to its network-based attack vector, low attack complexity, and complete compromise of confidentiality, integrity, and availability. The vulnerability has a high EPSS score, indicating a significant likelihood of exploitation, and multiple public exploits, including Metasploit modules and ExploitDB entries, confirm its widespread exploitability. Despite its age, its historical impact and the availability of exploit code underscore its critical nature.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
2.0CPE matchmatch criteria | cpe:2.3:a:microsoft:index_server:2.0:*:*:*:*:*:*:* | ||
All Versions ImpactedCPE matchmatch criteria | cpe:2.3:a:microsoft:indexing_service:*:*:windows_2000:*:*:*:*:* | ||
<= 6.0CPE matchmatch criteria | cpe:2.3:a:microsoft:internet_information_server:*:beta:*:*:*:*:*:* |
CVSS version used by this source: 2.0
AV:N/AC:L/Au:N/C:C/I:C/A:C
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.