Microsoft Exchange 2000 Post Authorization License Exhaustion Denial Of Service Vulnerability

A vulnerability has been reported for Microsoft Exchange 2000.
Allegedly, Exchange 2000 will experience a denial of service condition when an authenticated user makes many requests. The vulnerability is due to IIS incorrectly allocating licenses to Exchange. Making numerous, rapid requests will exhaust available licenses granted to Exchange by IIS.

Information

Bugtraq ID: 5413
Class: Failure to Handle Exceptional Conditions
CVE: CVE-2002-1876

Remote: Yes
Local: No
Published: Aug 06 2002 12:00AM
Updated: May 31 2019 10:00PM
Credit: Reported by Dave Aitel <[email protected]>.
Vulnerable: Microsoft Exchange Server 2000 SP2
Microsoft Exchange Server 2000 SP1
Microsoft Exchange Server 2000

Not Vulnerable:

Exploit

Reportedly, these issues may be exploited with the publically available Spike tool, available at the following URL:
http://www.immunitysec.com/spike.html

References:

Exchange Server Home Page (Microsoft)
Microsoft Technet Security (Microsoft)

Source: www.securityfocus.com

Exploit Collector

Search Exploit