CVE-2017-7269
Microsoft Internet Information Services (IIS): Windows Server Buffer Overflow
As of , CVE-2017-7269 in Microsoft Internet Information Services (IIS) is on CISA's list of exploited vulnerabilities: CISA listed it on . Our patch-first group: Patch this week.
- Exploited
- Yes: CISA listed it on 3 November 2021
- US federal deadline
- 3 May 2022181 days after CISA listed it. US federal civilian agencies must fix it by then.
- Used in ransomware campaigns
- Not known to CISA
- EPSS score
- 0.99Higher than 99% of the CVEs EPSS scores. EPSS estimates the chance of exploitation activity in the next 30 days.
- EPSS when listed
- Not availableCISA listed it before 4 February 2022, where the EPSS files we read begin.
- Public exploit
- 1 Metasploit module and 2 Exploit-DB entries (1 verified)
- Fix
- No vendor link in CISA's entry
What CISA says to do
Apply updates per vendor instructions.
CISA's required action
What the flaw is
Microsoft Windows Server 2003 R2 contains a buffer overflow vulnerability in Internet Information Services (IIS) 6.0 which allows remote attackers to execute code via a long header beginning with "If: <http://" in a PROPFIND request.
CISA's description
Buffer overflow in the ScStoragePathFromUrl function in the WebDAV service in Internet Information Services (IIS) 6.0 in Microsoft Windows Server 2003 R2 allows remote attackers to execute arbitrary code via a long header beginning with "If: <http://" in a PROPFIND request, as exploited in the wild in July or August 2016.
The CVE record's description, from mitre
- CVE published
- 27 March 2017
- Assigned by
- mitre
- CVSS
- 9.8 Critical (CVSS 3.1, from CISA-ADP)
- CWE-120
- Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
- CWE-119
- Improper Restriction of Operations within the Bounds of a Memory Buffer
- CISA SSVC, exploitation
- active
- CISA SSVC, automatable
- yes
- CISA SSVC, technical impact
- total
Timeline
- The CVE record was published.
- Exploit-DB published an exploit (EDB-ID 41738).
- Exploit-DB published an exploit (EDB-ID 41992).
- CISA added it to its list of exploited vulnerabilities.
- The US federal deadline to fix it.
Public exploits
Facts from Metasploit's module list and Exploit-DB's index; we never copy exploit code.
- Metasploit: Microsoft IIS WebDav ScStoragePathFromUrl Overflowexploit module, rank manual
- Exploit-DB: Microsoft IIS - WebDav 'ScStoragePathFromUrl' Remote Overflow (Metasploit)EDB-ID 41992, verified by Exploit-DB, 11 May 2017
- Exploit-DB: Microsoft IIS 6.0 - WebDAV 'ScStoragePathFromUrl' Remote Buffer OverflowEDB-ID 41738, 27 March 2017
Read further
- CVE recordcve.org
- NVD entrynvd.nist.gov
- CISA's catalogcisa.gov
- EPSS for this CVEapi.first.org