KLA10999 Arbitrary code execution vulnerability in Microsoft IIS

CVSS:

10.0

Detect date:

03/22/2017

Severity:

Critical

Description:

A buffer overflow vulnerability was found in in the WebDAV service in IIS (Internet Information Services) 6.0 in Microsoft Windows Server 2003 R2. By exploiting this vulnerability malicious users can execute arbitary code or cause a denial of service. This vulnerability can be exploited remotely via a long header beginning with “If: <http://” in a PROPFIND request.

Affected products:

Microsoft Windows Server 2003 R2

Solution:

Follow the instructions from the solution link to install a micropatch.
0patch Blog

Original advisories:

IIS exploit

Impacts:

ACE

Related products:

Microsoft Windows Server 2003

CVE-IDS:

CVE-2017-7269