Vulnerability Note VU#203126

Microsoft IIS contains vulnerability in NNTP service

Original Release date: 21 Oct 2004 | Last revised: 22 Oct 2004


A vulnerability in the NNTP component of Microsoft IIS may allow a remote attacker to compromise the affected system.


The Network News Transport Protocol (NNTP) is a protocol for the distribution, inquiry, retrieval, and posting of news articles over a network. Microsoft's Internet Information Services (IIS) provides support for a number of protocols, including NNTP. In addition to the original protocol specification in IETF RFC977, a number of standard extensions to NNTP are specified in RFC2980. One of these, the XPAT command, is used to retrieve specific headers from specific articles, based on pattern matching on the contents of the header. Several related flaws exist in the way the NNTP component handles the parsing and translation of user-supplied search patterns. These flaws result in a vulnerability that could be exploited by an attacker with the ability to send a specially crafted message to the affected server.


A remote unauthenticated attacker may be able to execute code of their choosing with administrative privileges on the affected system.


Apply a patch from the vendor

Microsoft has published Microsoft Security Bulletin MS04-036 in response to this issue. Users are strongly encouraged to review this bulletin and apply the patches it refers to.


In addition to the patches referenced above, Microsoft has published workarounds for this issue. Users who are unable to apply the patches are strongly encouraged to implement these workarounds as appropriate.

Systems Affected (Learn More)

VendorStatusDate NotifiedDate Updated
Microsoft CorporationAffected-13 Oct 2004
If you are a vendor and your product is affected, let us know.

CVSS Metrics (Learn More)

Group Score Vector
Base N/A N/A
Temporal N/A N/A
Environmental N/A N/A



Thanks to Lucas Lavarello and Juliano Rizzo of Core Security Technologies for reporting this issue.

This document was written by Chad R Dougherty based on information provided by Microsoft and Core Security Technologies.

Other Information

  • CVE IDs: CAN-2004-0574
  • Date Public: 12 Oct 2004
  • Date First Published: 21 Oct 2004
  • Date Last Updated: 22 Oct 2004
  • Severity Metric: 30.06
  • Document Revision: 12


If you have feedback, comments, or additional information about this vulnerability, please send us email.