Microsoft ASP

The underlying issue is CVE-2007-2897: sending a request like /AUX/.aspx to Microsoft IIS 6.0 can trip ASP.NET into a temporary denial-of-service condition by abusing reserved MS-DOS device names. In practice, the real affected population is old IIS 6.0 deployments—typically Windows Server 2003-era systems running ASP.NET 1.1—while Tenable plugin 64589 is intentionally broad and, in PCI mode, reports ASP.NET 1.1 or even undetermined ASP.NET with manual verification required.

Tenable's MEDIUM is still generous for patch-prioritization purposes. NVD's old CVSS v2 7.5 is inflated by speculative claims around COM-port data access and even physical-access code execution; Tenable itself says its researchers concluded this is DoS only. That leaves you with a narrow, legacy, externally reachable, unauthenticated nuisance on a platform that should already be in retirement—not something that deserves urgent enterprise-wide patch motion.

Why this verdict

• Vendor baseline drops immediately: Tenable itself says its researchers concluded this is DoS only, which undercuts the older NVD 7.5 story.
• Reachable population is narrow: real exposure requires IIS 6.0 / Windows Server 2003-era ASP.NET, not generic modern ASP.NET on current IIS.
• Scanner confidence is limited: plugin 64589 runs for PCI checks and explicitly says manual verification is required, so raw hit counts will include false positives and version ambiguity.
• Attacker value is low: the chain gives temporary service disruption, not a practical remote foothold for lateral movement or privilege gain.
• Modern controls add friction: reverse proxies, request filtering, WAF normalization, and rate limiting all make the original 2007 path less reliable today.

Why not higher?

This does not deserve MEDIUM or above because the business impact is mostly bounded to availability, and even that requires a very specific, obsolete deployment profile. There is no strong present-day exploitation evidence, no KEV listing, and no compelling reason to treat speculative physical-port side effects as a real remote enterprise risk amplifier.

Why not lower?

I did not mark it IGNORE because the underlying behavior is real and unauthenticated remote abuse is possible on genuinely exposed IIS 6.0 systems. If you still have an internet-facing Windows Server 2003 / IIS 6.0 application, a nuisance DoS against a legacy revenue path can still hurt you operationally.

1. Validate every Nessus hit — Confirm whether the host is actually IIS 6.0 with ASP.NET 1.1 or another legacy ASP.NET path before opening patch tickets. For a LOW verdict there is no mitigation SLA; treat validation as backlog hygiene and close false positives aggressively.
2. Block reserved DOS device names — At the edge proxy, WAF, or IIS layer, deny requests containing reserved names such as AUX, CON, PRN, NUL, COM1-COM9, and LPT1-LPT9 in path segments. Tenable specifically recommends an ISAPI filter; for a LOW verdict, implement as normal backlog hygiene unless the server is internet-facing and business-critical.
3. Hide the app behind a modern front end — If the legacy app must stay alive, front it with a reverse proxy or ADC that normalizes paths, rate-limits bursts, and blocks malformed URL patterns. This is the practical containment move when you cannot retire the old stack immediately; for LOW, do it in routine change windows.
4. Retire IIS 6.0 / Server 2003 — The real control is not 'patching' this CVE but removing the entire unsupported platform. Because the verdict is LOW, this sits in backlog hygiene unless the asset is externally exposed, in which case it should be tied to your broader legacy-host eradication program.

Run this on the target Windows host from an elevated cmd.exe session. Example: check_iis6_aspnet_dos.bat; it needs local registry read access and works best on the affected legacy systems themselves. It reports VULNERABLE when it finds IIS 6.0 plus .NET Framework 1.1, PATCHED when the host is not in that affected set, and UNKNOWN if it cannot decide.

@echo off
setlocal ENABLEEXTENSIONS ENABLEDELAYEDEXPANSION
REM check_iis6_aspnet_dos.bat

REM Detect likely exposure to CVE-2007-2897 / Tenable plugin 64589.

REM Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN


set IIS6=0
set DOTNET11=0
set UNKNOWN=0

REM --- Detect IIS major version ---

for /f "tokens=2,*" %%A in ('reg query "HKLM\SOFTWARE\Microsoft\InetStp" /v MajorVersion 2^>nul ^| find /i "MajorVersion"') do (
  set IISMAJOR=%%B
)
if defined IISMAJOR (
  echo !IISMAJOR! | findstr /r /c:"0x6" /c:" 6$" >nul && set IIS6=1
) else (
  for /f "tokens=2,*" %%A in ('reg query "HKLM\SOFTWARE\Microsoft\InetStp" /v VersionString 2^>nul ^| find /i "VersionString"') do (
    set IISVERSTR=%%B
  )
  if defined IISVERSTR (
    echo !IISVERSTR! | find /i "Version 6.0" >nul && set IIS6=1
  ) else (
    REM No IIS registry keys found; assume IIS not installed

    set IIS6=0
  )
)

REM --- Detect .NET Framework 1.1 ---

for %%K in (
  "HKLM\SOFTWARE\Microsoft\NET Framework Setup\NDP\v1.1.4322"
  "HKLM\SOFTWARE\WOW6432Node\Microsoft\NET Framework Setup\NDP\v1.1.4322"
) do (
  for /f "tokens=2,*" %%A in ('reg query %%~K /v Install 2^>nul ^| find /i "Install"') do (
    set DN11=%%B
    echo !DN11! | findstr /r /c:"0x1" /c:" 1$" >nul && set DOTNET11=1
  )
)

REM --- Sanity check ---

if "%IIS6%"=="0" if "%DOTNET11%"=="0" (
  echo PATCHED
  REM Not in the known affected legacy stack

  exit /b 0
)

if "%IIS6%"=="1" if "%DOTNET11%"=="1" (
  echo VULNERABLE
  REM Host matches IIS 6.0 + .NET 1.1 profile used by this finding

  exit /b 1
)

REM Mixed signals: perhaps IIS 6.0 without ASP.NET 1.1, or detection ambiguity.

REM This script cannot verify ISAPI-filter mitigation automatically.

echo UNKNOWN
exit /b 2

Sources

1. Tenable Nessus Plugin 64589
2. Full Disclosure original post by kingcope (2007-05-22)
3. Full Disclosure follow-up by 3APA3A (2007-05-23)
4. Microsoft Learn: Running ASP.NET 1.1 with IIS 6.0
5. Microsoft Lifecycle: Windows Server 2003
6. Bitsight Groma: Microsoft IIS 6.0 Observation Footprint
7. CISA Known Exploited Vulnerabilities Catalog
8. Vulnerability-Lookup / CIRCL entry for CVE-2007-2897