CVE-2017-7269
Microsoft Windows Server Buffer Overflow Vulnerability
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
11Exploited in Wild
YesDecision
Descriptions
Buffer overflow in the ScStoragePathFromUrl function in the WebDAV service in Internet Information Services (IIS) 6.0 in Microsoft Windows Server 2003 R2 allows remote attackers to execute arbitrary code via a long header beginning with "If: <http://" in a PROPFIND request, as exploited in the wild in July or August 2016.
Desbordamiento de búfer en la función ScStoragePathFromUrl en el servicio WebDAV en Internet Information Services (IIS) 6.0 en Microsoft Windows Server 2003 R2 permite a atacantes remotos ejecutar código arbitrario a través de una cabecera larga comenzando con "If:
Microsoft IIS version 6.0 suffers from a WebDAV ScStoragePathFromUrl buffer overflow vulnerability.
Microsoft Windows Server 2003 R2 contains a buffer overflow vulnerability in Internet Information Services (IIS) 6.0 which allows remote attackers to execute code via a long header beginning with "If: <http://" in a PROPFIND request.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2017-03-26 CVE Reserved
- 2017-03-27 CVE Published
- 2017-03-29 First Exploit
- 2021-11-03 Exploited in Wild
- 2022-05-03 KEV Due Date
- 2024-08-05 CVE Updated
- 2024-10-09 EPSS Updated
CWE
- CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
CAPEC
References (19)
| URL | Tag | Source |
|---|---|---|
| http://www.securityfocus.com/bid/97127 | Vdb Entry | |
| http://www.securitytracker.com/id/1038168 | Vdb Entry | |
| https://0patch.blogspot.com/2017/03/0patching-immortal-cve-2017-7269.html | X_refsource_misc | |
| https://github.com/danigargu/explodingcan | X_refsource_misc | |
| https://github.com/edwardz246003/IIS_exploit | Third Party Advisory | |
| https://github.com/rapid7/metasploit-framework/pull/8162 | X_refsource_misc | |
| https://medium.com/%40iraklis/number-of-internet-facing-vulnerable-iis-6-0-to-cve-2017-7269-8bd153ef5812 | X_refsource_misc | |
| https://support.microsoft.com/en-us/help/3197835/description-of-the-security-update-for-windows-xp-and-windows-server | X_refsource_confirm |
| URL | Date | SRC |
|---|---|---|
| https://www.exploit-db.com/exploits/41992 | 2024-08-05 | |
| https://www.exploit-db.com/exploits/41738 | 2024-08-05 | |
| https://github.com/g0rx/iis6-exploit-2017-CVE-2017-7269 | 2017-04-05 | |
| https://github.com/lcatro/CVE-2017-7269-Echo-PoC | 2018-10-27 | |
| https://github.com/Al1ex/CVE-2017-7269 | 2018-04-28 | |
| https://github.com/caicai1355/CVE-2017-7269-exploit | 2017-03-29 | |
| https://github.com/N3rdyN3xus/CVE-2017-7269 | 2021-07-16 | |
| https://github.com/VanishedPeople/CVE-2017-7269 | 2024-08-08 | |
| https://github.com/denchief1/CVE-2017-7269 | 2022-08-29 | |
| https://github.com/Cappricio-Securities/CVE-2017-7269 | 2024-06-21 | |
| https://github.com/ThanHuuTuan/CVE-2017-7269 | 2017-04-04 |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Microsoft Search vendor "Microsoft" | Internet Information Server Search vendor "Microsoft" for product "Internet Information Server" | 6.0 Search vendor "Microsoft" for product "Internet Information Server" and version "6.0" | - |
Affected
| in | Microsoft Search vendor "Microsoft" | Windows Server 2003 Search vendor "Microsoft" for product "Windows Server 2003" | - | r2 |
Safe
|