CVE-2006-1364

HIGH 7.5CVE-2006-1364 · Published 23/03/2006 · updated 16/06/2026

Package	Affected versions	Patched versions
asp.net microsoft	`= 1.1≤ 1.1`	No fix yet

Description

Microsoft w3wp (aka w3wp.exe) does not properly handle when the AspCompat directive is not used when referencing COM components in ASP.NET, which allows remote attackers to cause a denial of service (resource consumption or crash) by repeatedly requesting each of several documents that refer to COM components, or are restricted documents located under the ASP.NET application path.

References

hackingspirits.com/vuln-rnd/w3wp-remote-dos.zip · Broken Link
lists.grok.org.uk/pipermail/full-disclosure/2006-March/044291.html · Third Party Advisory
lists.grok.org.uk/pipermail/full-disclosure/2006-March/044292.html · Third Party Advisory
securitytracker.com/id · Third Party Advisory
securiteam.com/windowsntfocus/5KP0O0KI0Y.html · Exploit
securityfocus.com/archive/1/428622/100/0/threaded
securityfocus.com/bid/17188 · Exploit
exchange.xforce.ibmcloud.com/vulnerabilities/25392 · Third Party Advisory
exploit-db.com/exploits/1601 · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free