Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.0

Microsoft Site Server 3.0 can run out of disk space

CVE-2002-2081 · published 23 years ago
Summary

A part of Microsoft Site Server 3.0 called cphost.dll can be tricked by sending a specially crafted web request with an overly long URL field. The request makes the server write a huge temporary file, eventually filling the drive and stopping the service. Apply Microsoft's patch or block the affected request path and monitor disk usage to prevent the outage.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
microsoft site_server 3.0
cpe:2.3:a:microsoft:site_server:3.0:*:i386:*:*:*:*:*
microsoft site_server_commerce 3.0
cpe:2.3:a:microsoft:site_server_commerce:3.0:*:*:*:*:*:*:*
Original advisory text
cphost.dll in Microsoft Site Server 3.0 allows remote attackers to cause a denial of service (disk consumption) via an HTTP POST of a file with a long TargetURL parameter, which causes Site Server ...
cphost.dll in Microsoft Site Server 3.0 allows remote attackers to cause a denial of service (disk consumption) via an HTTP POST of a file with a long TargetURL parameter, which causes Site Server to abort and leaves the uploaded file in c:\temp.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
5.0 Medium
Exploitation
15% chance of attack within 30 days
Timeline
Published31 Dec 2002
Updated8 Oct 2026
First seen29 Sep 2026
Sources
CVE-2002-2081 · NVD
Track software like this
Free during beta