CVE-2003-0227 json
The logging capability for unicast and multicast transmissions in the ISAPI extension for Microsoft Windows Media Services in Microsoft Win…
published 2003-05-30 23 y ago modified 2026-06-16 4 mo ago also EUVD-2003-0222
- cvss
- 5.0
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 34.4%
- EPSS 34.4% chance of exploitation in 30 days, percentile 98%
- public exploits
- 1
- Exploit-DB
Summary
The logging capability for unicast and multicast transmissions in the ISAPI extension for Microsoft Windows Media Services in Microsoft Windows NT 4.0 and 2000, nsiislog.dll, allows remote attackers to cause a denial of service in Internet Information Server (IIS) and execute arbitrary code via a certain network request.
Timeline
- Published
- First public exploit (EDB-56)
Exploit prediction
34.40% chance of exploitation in the next 30 days, higher than 98% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- EDB-56 Microsoft Windows Media Services - 'nsiislog.dll' Remote Overflow remote, 2003-07-14
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:N/I:N/A:P |
Classification
- Weakness
-
- CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
References
-
docs.microsoft.com
/en-us/security-updates/securitybulletins/2003/ms03-019
vendor-advisory
-
oval.cisecurity.org
/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A966
vdb-entry, signature, third-party-advisory
-
marc.info
/?l=bugtraq&m=105427615626177&w=2
mailing-list, issue-tracking, third-party-advisory
-
marc.info
/?l=ntbugtraq&m=105421176432011&w=2
mailing-list, issue-tracking, third-party-advisory
-
marc.info
/?l=ntbugtraq&m=105421127531558&w=2
mailing-list, issue-tracking, third-party-advisory
-
oval.cisecurity.org
/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A936
vdb-entry, signature, third-party-advisory
Sources
- CVE List CVE-2003-0227
- NVD CVE-2003-0227
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.