CVE-2017-7269 Buffer overflow in the ScStoragePathFromUrl function in the WebDAV service in Internet Information Services (IIS) 6.0 in Microsoft Windows Server 2003 R2 allows remote attackers to execute arbitrary c...
CriticalCVSS 9.8
EPSS 99.8%
CISA KEV
added 2021-11-03 · due 2022-05-03
Exploited in the wild
Framework module
Public exploit
PoC
- Published
- Updated
- Exploit status
- Exploited in the wild (confirmed)
Description
Buffer overflow in the ScStoragePathFromUrl function in the WebDAV service in Internet Information Services (IIS) 6.0 in Microsoft Windows Server 2003 R2 allows remote attackers to execute arbitrary code via a long header beginning with "If: <http://" in a PROPFIND request, as exploited in the wild in July or August 2016.
CISA Known Exploited Vulnerability
- Date added
- 2021-11-03
- Due date (FCEB)
- 2022-05-03
- Ransomware use
- Unknown
Required action
Apply updates per vendor instructions.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Microsoft internet information services | = 6.0 | No fix listed |
References
- 97127 broken-link third-party-advisory vdb-entry
- 1038168 broken-link third-party-advisory vdb-entry
- 0patch.blogspot.com exploit third-party-advisory
- github.com exploit
- github.com broken-link third-party-advisory
- github.com issue-tracking patch
- medium.com exploit
- support.microsoft.com broken-link patch vendor-advisory
- 41738 exploit third-party-advisory vdb-entry
- 41992 exploit third-party-advisory vdb-entry
- www.cisa.gov government-resource us-government-resource