CVE-2004-1134 — AI Deep Analysis Summary

🚨 **Essence**: Buffer Overflow in `w3who.dll` (Web Whoami ISAPI). 💥 **Consequences**: Remote attackers send **long query strings** → **Denial of Service** (DoS) or **Arbitrary Code Execution**.

🛡️ **Root Cause**: Classic **Buffer Overflow** flaw. The component fails to validate input length, allowing overflow into memory. ⚠️ **CWE**: Not specified in data.

🏢 **Affected**: **Microsoft IIS** servers. 📦 **Component**: `w3who.dll` (Web-based Whoami ISAPI library). 📅 **Published**: Dec 8, 2004.

💀 **Attacker Actions**: 1. **DoS**: Crash the service. 2. **RCE**: Execute **arbitrary code** on the server. 🔓 **Privileges**: Likely **System/Admin** level depending on IIS config.

🔓 **Threshold**: **LOW**. 🌐 **Auth**: **Remote** & **Unauthenticated**. 📝 **Config**: Requires `w3who.dll` to be installed/enabled in IIS.

📢 **Public Exp?**: **YES**. References include **X-Force**, **Full Disclosure** mailing list, and **Exaprobe** advisory. 📜 **Tags**: `vdb-entry`, `full-disclosure`.

🔍 **Self-Check**: Scan for `w3who.dll` in IIS ISAPI filters. 🧪 **Test**: Send **oversized query strings** to Whoami endpoints. ⚠️ **Warning**: Do not test in production!

🩹 **Official Fix**: **Patch/Update** IIS or remove `w3who.dll`. 📉 **Status**: Vulnerability is from 2004; modern IIS versions likely do not include this legacy DLL.

🚧 **No Patch?**: 1. **Disable/Remove** `w3who.dll` from IIS. 2. **Block** external access to Whoami endpoints via Firewall/WAF. 🛑 **Mitigation**: Input validation at gateway.

🔥 **Urgency**: **HIGH** (Historically). 📉 **Current**: **LOW** for modern systems. ⚠️ **Note**: Critical if running **legacy IIS** with this specific DLL. Prioritize removal of obsolete components.