CVE-2001-0327

MediumCVSS 5.0/10Last modified Jun 16, 2026

Description

iPlanet Web Server Enterprise Edition 4.1 and earlier allows remote attackers to retrieve sensitive data from memory allocation pools, or cause a denial of service, via a URL-encoded Host: header in the HTTP request, which reveals memory in the Location: header that is returned by the server.

Metrics

CVSS 2.0 5.0/10AV:N/AC:L/Au:N/C:P/I:N/A:N

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.atstake.com/research/advisories/2001/a041601-1.txtPatch, Vendor Advisory
http://www.iplanet.com/products/iplanet_web_enterprise/iwsalert4.16.html
http://www.kb.cert.org/vuls/id/276767US Government Resource
http://www.osvdb.org/5704
http://www.atstake.com/research/advisories/2001/a041601-1.txtPatch, Vendor Advisory
http://www.iplanet.com/products/iplanet_web_enterprise/iwsalert4.16.html
http://www.kb.cert.org/vuls/id/276767US Government Resource
http://www.osvdb.org/5704

Timeline

Published: Jul 2, 2001
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2001

CVE-2001-03285.0TCP implementations that use random increments for initial sequence numbers (ISN) can allow remote attackers to perform session hijacking or CVE-2001-03297.5Bugzilla 2.10 allows remote attackers to execute arbitrary commands via shell metacharacters in a username that is then processed by (1) the CVE-2001-03307.5Bugzilla 2.10 allows remote attackers to access sensitive information, including the database username and password, via an HTTP request for CVE-2001-03317.5Buffer overflow in Embedded Support Partner (ESP) daemon (rpc.espd) in IRIX 6.5.8 and earlier allows remote attackers to execute arbitrary c CVE-2001-03325.0Internet Explorer 5.5 and earlier does not properly verify the domain of a frame within a browser window, which allows remote web site opera CVE-2001-03337.5Directory traversal vulnerability in IIS 5.0 and earlier allows remote attackers to execute arbitrary commands by encoding .. (dot dot) and CVE-2001-03347.5FTP service in IIS 5.0 and earlier allows remote attackers to cause a denial of service via a wildcard sequence that generates a long string CVE-2001-03355.0FTP service in IIS 5.0 and earlier allows remote attackers to enumerate Guest accounts in trusted domains by preceding the username with a s CVE-2001-03365.0The Microsoft MS00-060 patch for IIS 5.0 and earlier introduces an error which allows attackers to cause a denial of service via a malformed CVE-2001-03375.0The Microsoft MS01-014 and MS01-016 patches for IIS 5.0 and earlier introduce a memory leak which allows attackers to cause a denial of serv CVE-2001-03385.1Internet Explorer 5.5 and earlier does not properly validate digital certificates when Certificate Revocation List (CRL) checking is enabled CVE-2001-03397.5Internet Explorer 5.5 and earlier allows remote attackers to display a URL in the address bar that is different than the URL that is actuall