CVE-2001-1533 - Vulnerability Details - OpenCVE

Microsoft Internet Security and Acceleration (ISA) Server 2000 allows remote attackers to cause a denial of service via a flood of fragmented UDP packets. NOTE: the vendor disputes this issue, saying that it requires high bandwidth to exploit, and the server does not experience any instability. Therefore this "laws of physics" issue might not be included in CVE

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact None

Integrity Impact None

Availability Impact Partial

This CVE is not in the KEV list.

The EPSS score is 0.26888.

Exploitation none

Automatable yes

Technical Impact partial

Vendors	Products
Microsoft Subscribe	Isa Server Subscribe

Configuration 1 [-]

cpe:2.3:a:microsoft:isa_server:2000:*:*:*:*:*:*:*

No data.

No data.

Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
http://cert.uni-stuttgart.de/archive/bugtraq/2001/11/msg00018.html
http://cert.uni-stuttgart.de/archive/bugtraq/2001/11/msg00031.html
http://www.iss.net/security_center/static/7446.php
http://www.securityfocus.com/bid/3501

History

Thu, 16 Jan 2025 20:15:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'}` ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Projects

Sign in to view the affected projects.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2005-07-14T04:00:00Z

Updated: 2025-01-16T19:29:17.831Z

Reserved: 2005-07-14T00:00:00Z

Link: CVE-2001-1533

Vulnrichment

Updated: 2024-08-08T04:58:11.600Z

NVD

Status : Deferred

Published: 2001-12-31T05:00:00.000

Modified: 2025-04-03T01:03:51.193

Link: CVE-2001-1533

Redhat

No data.

OpenCVE Enrichment

No data.

Weaknesses

NVD-CWE-Other

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "descriptions": [{"lang": "en", "value": "Microsoft Internet Security and Acceleration (ISA) Server 2000 allows remote attackers to cause a denial of service via a flood of fragmented UDP packets. NOTE: the vendor disputes this issue, saying that it requires high bandwidth to exploit, and the server does not experience any instability. Therefore this \"laws of physics\" issue might not be included in CVE"}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2005-07-14T04:00:00Z", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "3501", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/3501"}, {"name": "isa-udp-flood-dos(7446)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "http://www.iss.net/security_center/static/7446.php"}, {"name": "20051101 RE: Microsoft ISA Server Fragmented Udp Flood Vulnerability", "tags": ["mailing-list", "x_refsource_BUGTRAQ"], "url": "http://cert.uni-stuttgart.de/archive/bugtraq/2001/11/msg00031.html"}, {"name": "20011102 Microsoft ISA Server Fragmented Udp Flood Vulnerability", "tags": ["mailing-list", "x_refsource_BUGTRAQ"], "url": "http://cert.uni-stuttgart.de/archive/bugtraq/2001/11/msg00018.html"}], "tags": ["disputed"], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2001-1533", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "** DISPUTED * Microsoft Internet Security and Acceleration (ISA) Server 2000 allows remote attackers to cause a denial of service via a flood of fragmented UDP packets. NOTE: the vendor disputes this issue, saying that it requires high bandwidth to exploit, and the server does not experience any instability. Therefore this \"laws of physics\" issue might not be included in CVE."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "3501", "refsource": "BID", "url": "http://www.securityfocus.com/bid/3501"}, {"name": "isa-udp-flood-dos(7446)", "refsource": "XF", "url": "http://www.iss.net/security_center/static/7446.php"}, {"name": "20051101 RE: Microsoft ISA Server Fragmented Udp Flood Vulnerability", "refsource": "BUGTRAQ", "url": "http://cert.uni-stuttgart.de/archive/bugtraq/2001/11/msg00031.html"}, {"name": "20011102 Microsoft ISA Server Fragmented Udp Flood Vulnerability", "refsource": "BUGTRAQ", "url": "http://cert.uni-stuttgart.de/archive/bugtraq/2001/11/msg00018.html"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-08T04:58:11.600Z"}, "title": "CVE Program Container", "references": [{"name": "3501", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/3501"}, {"name": "isa-udp-flood-dos(7446)", "tags": ["vdb-entry", "x_refsource_XF", "x_transferred"], "url": "http://www.iss.net/security_center/static/7446.php"}, {"name": "20051101 RE: Microsoft ISA Server Fragmented Udp Flood Vulnerability", "tags": ["mailing-list", "x_refsource_BUGTRAQ", "x_transferred"], "url": "http://cert.uni-stuttgart.de/archive/bugtraq/2001/11/msg00031.html"}, {"name": "20011102 Microsoft ISA Server Fragmented Udp Flood Vulnerability", "tags": ["mailing-list", "x_refsource_BUGTRAQ", "x_transferred"], "url": "http://cert.uni-stuttgart.de/archive/bugtraq/2001/11/msg00018.html"}]}, {"problemTypes": [{"descriptions": [{"type": "CWE", "lang": "en", "description": "CWE-noinfo Not enough information"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-03-21T15:57:24.602314Z", "id": "CVE-2001-1533", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-01-16T19:29:17.831Z"}}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2001-1533", "datePublished": "2005-07-14T04:00:00Z", "dateReserved": "2005-07-14T00:00:00Z", "dateUpdated": "2025-01-16T19:29:17.831Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.securityfocus.com/bid/3501", "name": "3501", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"]}, {"url": "http://www.iss.net/security_center/static/7446.php", "name": "isa-udp-flood-dos(7446)", "tags": ["vdb-entry", "x_refsource_XF", "x_transferred"]}, {"url": "http://cert.uni-stuttgart.de/archive/bugtraq/2001/11/msg00031.html", "name": "20051101 RE: Microsoft ISA Server Fragmented Udp Flood Vulnerability", "tags": ["mailing-list", "x_refsource_BUGTRAQ", "x_transferred"]}, {"url": "http://cert.uni-stuttgart.de/archive/bugtraq/2001/11/msg00018.html", "name": "20011102 Microsoft ISA Server Fragmented Udp Flood Vulnerability", "tags": ["mailing-list", "x_refsource_BUGTRAQ", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-08T04:58:11.600Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2001-1533", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-03-21T15:57:24.602314Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "description": "CWE-noinfo Not enough information"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-01-16T19:29:07.567Z"}}], "cna": {"tags": ["disputed"], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "references": [{"url": "http://www.securityfocus.com/bid/3501", "name": "3501", "tags": ["vdb-entry", "x_refsource_BID"]}, {"url": "http://www.iss.net/security_center/static/7446.php", "name": "isa-udp-flood-dos(7446)", "tags": ["vdb-entry", "x_refsource_XF"]}, {"url": "http://cert.uni-stuttgart.de/archive/bugtraq/2001/11/msg00031.html", "name": "20051101 RE: Microsoft ISA Server Fragmented Udp Flood Vulnerability", "tags": ["mailing-list", "x_refsource_BUGTRAQ"]}, {"url": "http://cert.uni-stuttgart.de/archive/bugtraq/2001/11/msg00018.html", "name": "20011102 Microsoft ISA Server Fragmented Udp Flood Vulnerability", "tags": ["mailing-list", "x_refsource_BUGTRAQ"]}], "descriptions": [{"lang": "en", "value": "Microsoft Internet Security and Acceleration (ISA) Server 2000 allows remote attackers to cause a denial of service via a flood of fragmented UDP packets. NOTE: the vendor disputes this issue, saying that it requires high bandwidth to exploit, and the server does not experience any instability. Therefore this \"laws of physics\" issue might not be included in CVE"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "n/a"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2005-07-14T04:00:00Z"}, "x_legacyV4Record": {"affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"version": {"version_data": [{"version_value": "n/a"}]}, "product_name": "n/a"}]}, "vendor_name": "n/a"}]}}, "data_type": "CVE", "references": {"reference_data": [{"url": "http://www.securityfocus.com/bid/3501", "name": "3501", "refsource": "BID"}, {"url": "http://www.iss.net/security_center/static/7446.php", "name": "isa-udp-flood-dos(7446)", "refsource": "XF"}, {"url": "http://cert.uni-stuttgart.de/archive/bugtraq/2001/11/msg00031.html", "name": "20051101 RE: Microsoft ISA Server Fragmented Udp Flood Vulnerability", "refsource": "BUGTRAQ"}, {"url": "http://cert.uni-stuttgart.de/archive/bugtraq/2001/11/msg00018.html", "name": "20011102 Microsoft ISA Server Fragmented Udp Flood Vulnerability", "refsource": "BUGTRAQ"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "eng", "value": "** DISPUTED * Microsoft Internet Security and Acceleration (ISA) Server 2000 allows remote attackers to cause a denial of service via a flood of fragmented UDP packets. NOTE: the vendor disputes this issue, saying that it requires high bandwidth to exploit, and the server does not experience any instability. Therefore this \"laws of physics\" issue might not be included in CVE."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2001-1533", "STATE": "PUBLIC", "ASSIGNER": "cve@mitre.org"}}}}, "cveMetadata": {"cveId": "CVE-2001-1533", "state": "PUBLISHED", "dateUpdated": "2025-01-16T19:29:17.831Z", "dateReserved": "2005-07-14T00:00:00Z", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2005-07-14T04:00:00Z", "assignerShortName": "mitre"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:isa_server:2000:*:*:*:*:*:*:*", "matchCriteriaId": "80744BD9-85A9-4E33-8C35-59C8C112AC62", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [{"sourceIdentifier": "cve@mitre.org", "tags": ["disputed"]}], "descriptions": [{"lang": "en", "value": "Microsoft Internet Security and Acceleration (ISA) Server 2000 allows remote attackers to cause a denial of service via a flood of fragmented UDP packets. NOTE: the vendor disputes this issue, saying that it requires high bandwidth to exploit, and the server does not experience any instability. Therefore this \"laws of physics\" issue might not be included in CVE"}], "id": "CVE-2001-1533", "lastModified": "2025-04-03T01:03:51.193", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 5.0, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2001-12-31T05:00:00.000", "references": [{"source": "cve@mitre.org", "url": "http://cert.uni-stuttgart.de/archive/bugtraq/2001/11/msg00018.html"}, {"source": "cve@mitre.org", "url": "http://cert.uni-stuttgart.de/archive/bugtraq/2001/11/msg00031.html"}, {"source": "cve@mitre.org", "url": "http://www.iss.net/security_center/static/7446.php"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/bid/3501"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://cert.uni-stuttgart.de/archive/bugtraq/2001/11/msg00018.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://cert.uni-stuttgart.de/archive/bugtraq/2001/11/msg00031.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.iss.net/security_center/static/7446.php"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/bid/3501"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}], "source": "nvd@nist.gov", "type": "Primary"}]}