CVE-2009-2521

medium Microsoft
CVSS v3 Base Score
5.0
AV:N/AC:L/Au:N/C:N/I:N/A:P
EPSS Score
60.8%
Exploitation probability in 30 days
Top 2% most likely to be exploited
Attack Characteristics
Attack Vector
Network
Attack Complexity
Low
Confidentiality
None
Integrity
None
Availability
P
Published: September 4, 2009 (6096 days ago)
Last Modified: April 23, 2026
Vendor: Microsoft
Source: NVD

Description

Stack consumption vulnerability in the FTP Service in Microsoft Internet Information Services (IIS) 5.0 through 7.0 allows remote authenticated users to cause a denial of service (daemon crash) via a list (ls) -R command containing a wildcard that references a subdirectory, followed by a .. (dot dot), aka "IIS FTP Service DoS Vulnerability."

CWE

CWE-400

Affected Products

microsoft internet information services

References

🔗 archives.neohapsis.com 🔗 support.microsoft.com 🔗 www.us-cert.gov 🔗 docs.microsoft.com 🔗 oval.cisecurity.org