CVE-2000-0304 in IIS
Summary
by MITRE
Microsoft IIS 4.0 and 5.0 with the IISADMPWD virtual directory installed allows a remote attacker to cause a denial of service via a malformed request to the inetinfo.exe program, aka the "Undelimited .HTR Request" vulnerability.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 04/21/2026
The CVE-2000-0304 vulnerability represents a critical denial of service flaw affecting Microsoft Internet Information Services versions 4.0 and 5.0 when the IISADMPWD virtual directory is present. This vulnerability specifically targets the inetinfo.exe process responsible for managing IIS web server operations, creating a pathway for remote attackers to disrupt service availability. The vulnerability stems from inadequate input validation within the web server's request processing mechanism, particularly when handling .htr files which are used for server-side include operations and custom server extensions.
The technical flaw manifests when a remote attacker crafts a malformed HTTP request that contains an undelimited .htr file reference within the request path. This particular vulnerability operates by exploiting the way inetinfo.exe processes requests containing specially crafted .htr file references that lack proper delimiters or termination characters. When the web server attempts to process such malformed requests, the parsing logic fails to properly handle the undefined boundary conditions, causing the inetinfo.exe process to consume excessive system resources or enter an unstable state. The vulnerability is classified under CWE-129 as an improper limitation of a recognized maximum, specifically related to insufficient validation of input boundaries and delimiters. This flaw represents a classic buffer over-read condition where the web server's request parser fails to properly terminate string parsing operations.
The operational impact of this vulnerability is severe as it enables a remote attacker to perform a denial of service attack against IIS web servers without requiring any authentication or special privileges. The attack can be executed from anywhere on the network, making it particularly dangerous for publicly accessible web servers. When successful, the vulnerability causes the affected IIS service to become unresponsive or crash entirely, requiring manual intervention to restore normal operations. The affected inetinfo.exe process may consume all available memory or CPU resources, effectively preventing legitimate users from accessing web content. This vulnerability directly maps to attack techniques described in the MITRE ATT&CK framework under the T1499 category for Network Denial of Service, specifically targeting the service availability aspect of the attack lifecycle.
Mitigation strategies for CVE-2000-0304 require immediate implementation of security patches from Microsoft, specifically the security update released in conjunction with this vulnerability. Organizations should disable or remove the IISADMPWD virtual directory if it is not essential for operations, as this directory is the primary vector for exploitation. Network administrators should implement proper input validation at the firewall level to filter out malformed requests containing suspicious .htr file references. The recommended approach involves applying the Microsoft security bulletin MS00-022 patch which addresses the specific boundary condition handling issue in the inetinfo.exe process. Additionally, implementing intrusion detection systems that can identify and block malformed HTTP requests containing undelimited .htr references provides an additional layer of defense. System monitoring should be enhanced to detect unusual resource consumption patterns that may indicate exploitation attempts. Organizations should also consider implementing network segmentation to limit access to critical web servers and reduce the attack surface. The vulnerability demonstrates the importance of proper input validation and boundary checking in server-side applications, aligning with security best practices outlined in the OWASP Top Ten and NIST Cybersecurity Framework.