The issue has been introduced in 02/17/2000. The weakness was disclosed on 09/04/2009 by Kingcope.
Vulnerable component: Microsoft IIS
CVSSv3 score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:F/RL:O/RC:C
CWE-ID: CWE-20 - Improper Input Validation
The vulnerability allows a remote authenticated attacker to cause DoS conditions on the target system.
The weakness exists due to an error when processing recursive directory listing commands by the FTP Service. By sending a specially crafted LIST command containing wildcard characters, a remote attacker can trigger the FTP service to crash.
Successful exploitation of the vulnerability results in denial of service on the vulnerable system.
Note: the vulnerability was being actively exploited.