CVSS VectorNVD
AV:L/AC:L/Au:N/C:C/I:C/A:C
Lifecycle Timeline
5DescriptionNVD
IIS 5.0 uses relative paths to find system files that will run in-process, which allows local users to gain privileges via a Trojan horse file, aka the "System file listing privilege elevation" vulnerability.
AnalysisAI
Local privilege escalation in Microsoft Internet Information Services 5.0 allows authenticated local users to execute arbitrary code with SYSTEM privileges by placing malicious DLLs in search path locations that IIS uses to load in-process components. Publicly available exploit code exists. EPSS score of 2.16% (84th percentile) indicates lower exploitation probability, consistent with the local attack vector requiring pre-existing system access. Addressed by Microsoft MS01-044 security bulletin in 2001.
Technical ContextAI
Microsoft Internet Information Services 5.0, shipped with Windows 2000, uses relative path resolution when loading system DLLs and executables that run within the IIS process context (w3wp.exe or inetinfo.exe). When searching for required system files, IIS follows the Windows DLL search order, which checks the application directory before system directories. This insecure library loading behavior creates a DLL hijacking opportunity where local attackers can plant malicious files with names matching legitimate IIS components in directories earlier in the search path. Because IIS runs with LocalSystem privileges to manage web services, any code loaded into its process inherits these elevated privileges, enabling complete system compromise from an unprivileged local account.
RemediationAI
Apply the security update provided in Microsoft Security Bulletin MS01-044 (https://docs.microsoft.com/en-us/security-updates/securitybulletins/2001/ms01-044), which modifies IIS 5.0 to use absolute paths when loading system components, eliminating the relative path resolution vulnerability. Given that Windows 2000 and IIS 5.0 reached end-of-life in July 2010, Microsoft no longer provides security updates for these products. Organizations still running IIS 5.0 should prioritize migration to currently supported web server platforms (IIS 10.0 on Windows Server 2019/2022, nginx, Apache) rather than attempting to patch 23-year-old software. If immediate migration is not feasible, implement defense-in-depth controls: restrict local logon rights to only essential administrative accounts using Group Policy, enable filesystem auditing to detect unauthorized file placement in IIS directories (inetpub, system32, Windows directories in IIS search path), implement application whitelisting to prevent execution of unauthorized DLLs, and isolate IIS 5.0 systems on network segments with strict access controls. Note that these compensating controls do not eliminate the vulnerability but reduce attack surface by limiting who can exploit it.
Share
External POC / Exploit Code
Leaving vuln.today