CVE-2001-0500
Buffer overflow in ISAPI extension (idq.dll) in Index Server 2.0 and Indexing Service 2000 in IIS...
Buffer overflow in ISAPI extension (idq.dll) in Index Server 2.0 and Indexing Service 2000 in IIS 6.0 beta and earlier allows remote attackers to execute arbitrary commands via a long argument to Internet Data Administration (.ida) and Internet Data Query (.idq) files such as default.ida, as commonly exploited by Code Red.
Exploit likelihood
What each source reports
NVD Score used
Buffer overflow in ISAPI extension (idq.dll) in Index Server 2.0 and Indexing Service 2000 in IIS 6.0 beta and earlier allows remote attackers to execute arbitrary commands via a long argument to Internet Data Administration (.ida) and Internet Data Query (.idq) files such as default.ida, as commonly exploited by Code Red.
- Record
CVE-2001-0500- CVSS 2.0
- 10.0 High
AV:N/AC:L/Au:N/C:C/I:C/A:C - Updated
- 2026-11-02
CVE List No score
Buffer overflow in ISAPI extension (idq.dll) in Index Server 2.0 and Indexing Service 2000 in IIS 6.0 beta and earlier allows remote attackers to execute arbitrary commands via a long argument to Internet Data Administration (.ida) and Internet Data Query (.idq) files such as default.ida, as commonly exploited by Code Red.
- Record
CVE-2001-0500- Updated
- 2026-11-02
EUVDEUVD-2001-0496 No score
Buffer overflow in ISAPI extension (idq.dll) in Index Server 2.0 and Indexing Service 2000 in IIS 6.0 beta and earlier allows remote attackers to execute arbitrary commands via a long argument to Internet Data Administration (.ida) and Internet Data Query (.idq) files such as default.ida, as commonly exploited by Code Red.
- Record
EUVD-2001-0496- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-gcxg-pq25-8wh2 No score
Buffer overflow in ISAPI extension (idq.dll) in Index Server 2.0 and Indexing Service 2000 in IIS...
Buffer overflow in ISAPI extension (idq.dll) in Index Server 2.0 and Indexing Service 2000 in IIS 6.0 beta and earlier allows remote attackers to execute arbitrary commands via a long argument to Internet Data Administration (.ida) and Internet Data Query (.idq) files such as default.ida, as commonly exploited by Code Red.
- Record
GHSA-gcxg-pq25-8wh2- Updated
- 2026-11-02
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Microsoft IIS 5.0 - IDQ Path Overflow (MS01-033) (Metasploit) | 2010-06-15 |
| Exploit-DB | Microsoft Index Server 2.0 / Indexing Service (Windows 2000) - ISAPI Extension Buffer Overflow (PoC) | 2001-06-18 |
| Exploit-DB | Microsoft Index Server 2.0 / Indexing Service (Windows 2000) - ISAPI Extension Buffer Overflow (2) | 2001-06-21 |
| Exploit-DB | Microsoft Index Server 2.0 / Indexing Service (Windows 2000) - ISAPI Extension Buffer Overflow (3) | 2001-06-18 |
| Exploit-DB | Microsoft Index Server 2.0 / Indexing Service (Windows 2000) - ISAPI Extension Buffer Overflow (4) | 2001-06-18 |
| Metasploit | MS01-033 Microsoft IIS 5.0 IDQ Path Overflow | 2001-06-18 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, Metasploit, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2001-0500 is a high vulnerability (CVSS 10.0) in Microsoft Index Server, published July 21, 2001. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 96.7%, the 99th percentile. No source names a fixed version.
References
docs.microsoft.com/en-us/security-updates/securitybulletins/2001/ms01-033
securityfocus.com/archive/1/191873
ciac.org/ciac/bulletins/l-098.shtml
iss.net/security_center/static/6705.php
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A197
cert.org/advisories/CA-2001-13.html
nvd.nist.gov/vuln/detail/CVE-2001-0500
github.com/advisories/GHSA-gcxg-pq25-8wh2