CVE-2003-0718 The WebDAV Message Handler for Internet Information Services (IIS) 5.0, 5.1, and 6.0 allows remote attackers to cause a denial of service (memory and CPU exhaustion, application crash) via a PROPFIND....
MediumCVSS 5.0
EPSS 87.9%
PoC
- Published
- Updated
- Exploit status
- Proof-of-concept only
Description
The WebDAV Message Handler for Internet Information Services (IIS) 5.0, 5.1, and 6.0 allows remote attackers to cause a denial of service (memory and CPU exhaustion, application crash) via a PROPFIND request with an XML message containing XML elements with a large number of attributes.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Microsoft internet information server | = 6.0 | No fix listed |
| Microsoft internet information services | = 5.0 | No fix listed |
References
- 20041012 Microsoft IIS 5.x/6.0 WebDAV (XML parser) attribute blowup DoS mailing-list
- MS04-030 vendor-advisory
- iis-webdav-xml-attribute-dos(17645) vdb-entry
- iis-ms04030-patch(17656) vdb-entry
- oval:org.mitre.oval:def:1330 signature vdb-entry
- oval:org.mitre.oval:def:1427 signature vdb-entry
- oval:org.mitre.oval:def:4767 signature vdb-entry