CVE-2009-3023

Buffer overflow in the FTP Service in Microsoft Internet Information Services (IIS) 5.0 through 6.0 allows remote authenticated users to execute arbitrary code via a crafted NLST (NAME LIST) command that uses wildcards, leading to memory corruption, aka "IIS FTP Service RCE and DoS Vulnerability."

• CWE-120

• http://support.microsoft.com/default.aspx?scid=kb%3B%5BLN%5D%3BQ975191
• http://www.exploit-db.com/exploits/9541Exploit, Third Party Advisory, VDB Entry
• http://www.exploit-db.com/exploits/9559Exploit, Third Party Advisory, VDB Entry
• http://www.kb.cert.org/vuls/id/276653Third Party Advisory, US Government Resource
• http://www.securityfocus.com/bid/36189Exploit, Third Party Advisory, VDB Entry
• http://www.us-cert.gov/cas/techalerts/TA09-286A.htmlThird Party Advisory, US Government Resource
• http://www.vupen.com/english/advisories/2009/2481Third Party Advisory
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-053Patch, Vendor Advisory
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6080Third Party Advisory
• http://support.microsoft.com/default.aspx?scid=kb%3B%5BLN%5D%3BQ975191
• http://www.exploit-db.com/exploits/9541Exploit, Third Party Advisory, VDB Entry
• http://www.exploit-db.com/exploits/9559Exploit, Third Party Advisory, VDB Entry
• http://www.kb.cert.org/vuls/id/276653Third Party Advisory, US Government Resource
• http://www.securityfocus.com/bid/36189Exploit, Third Party Advisory, VDB Entry
• http://www.us-cert.gov/cas/techalerts/TA09-286A.htmlThird Party Advisory, US Government Resource
• http://www.vupen.com/english/advisories/2009/2481Third Party Advisory
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-053Patch, Vendor Advisory
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6080Third Party Advisory

Published

Aug 31, 2009

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2009-3017Orca Browser 1.2 build 5 does not properly block data: URIs …
• CVE-2009-3018Maxthon Browser 3.0.0.145 Alpha with Ultramode does not prop…
• CVE-2009-3019Microsoft Internet Explorer 6 on Windows XP SP2 and SP3, and…
• CVE-2009-3020win32k.sys in Microsoft Windows Server 2003 SP2 allows remot…
• CVE-2009-3021Cross-site scripting (XSS) vulnerability in Site Calendar 'm…
• CVE-2009-3022Cross-site request forgery (CSRF) vulnerability in bingo!CMS…6.5
• CVE-2009-3024The verify_hostname_of_cert function in the certificate chec…
• CVE-2009-3025Unspecified vulnerability in Pidgin 2.6.0 allows remote atta…
• CVE-2009-3026protocols/jabber/auth.c in libpurple in Pidgin 2.6.0, and po…
• CVE-2009-3027VRTSweb.exe in VRTSweb in Symantec Backup Exec Continuous Pr…
• CVE-2009-3028The Altiris eXpress NS SC Download ActiveX control in AeXNSP…
• CVE-2009-3029Cross-site scripting (XSS) vulnerability in the console in S…