A remote overflow exists in Microsoft IIS. The 'idq.dll' library fails to perform proper bounds checking resulting in a buffer overflow. With a specially crafted request containing an overly long argument to Internet Data Administration (.ida) and Internet Data Query (.idq) files, a remote attacker can cause arbitrary code execution resulting in a loss of integrity.

Currently, there are no known workarounds or upgrades to correct this issue. However, Microsoft has released a patch to address this vulnerability.

• CVE ID: 2001-0500 (see also: NVD)
• Bugtraq ID: 2880
• Metasploit ID: 568
• ISS X-Force ID: 6705
• CERT: CA-2001-13
• Keyword: Code Red IDQ
• Generic Exploit URL: http://immunitysec.com
• Generic Informational URL: http://oval.mitre.org/oval/definitions/pseudo/OVAL197.html
• Other Advisory URL: http://research.eeye.com/html/advisories/published/AD20010618.html
  http://www.eeye.com/html/research/advisories/AD20010618.html [ Link is 404 ]
• Vendor URL: http://www.microsoft.com/
• CIAC Advisory: l-098
• Microsoft Security Bulletin: MS01-033

• Riley Hassell - eEye Digital Security
• Ryan Permeh - eEye Digital Security