vulnwire
5.3med

CVE-2001-1533

Microsoft Internet Security and Acceleration (ISA) Server 2000 allows remote attackers to cause a denial of service via a flood of fragment…

Published 24 y ago · modified 4 mo ago · JSON

CVSS
5.3
v3.1 · CNA
CISA KEV
No
not known exploited
EPSS
18.0%
percentile 97%
Public exploits
0
none known

Microsoft Internet Security and Acceleration (ISA) Server 2000 allows remote attackers to cause a denial of service via a flood of fragmented UDP packets. NOTE: the vendor disputes this issue, saying that it requires high bandwidth to exploit, and the server does not experience any instability. Therefore this "laws of physics" issue might not be included in CVE

CISA SSVC assessment

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
2 y ago

Exploit prediction (EPSS)

18.01% probability of exploitation in the next 30 days, higher than 97% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
CISA ADP3.15.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CNA3.15.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
NVD2.05.0AV:N/AC:L/Au:N/C:N/I:N/A:P

References

  • securityfocus.com /bid/3501 · vdb-entry, x_refsource_BID, x_transferred
  • iss.net /security_center/static/7446.php · vdb-entry, x_refsource_XF, x_transferred
  • cert.uni-stuttgart.de /archive/bugtraq/2001/11/msg00031.html · mailing-list, x_refsource_BUGTRAQ, x_transferred
  • cert.uni-stuttgart.de /archive/bugtraq/2001/11/msg00018.html · mailing-list, x_refsource_BUGTRAQ, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.