CVE-2017-7269

nvd nist nuclei

Published: Mar 27, 2017Modified: Apr 21, 2026CISA KEV

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

Buffer overflow in the ScStoragePathFromUrl function in the WebDAV service in Internet Information Services (IIS) 6.0 in Microsoft Windows Server 2003 R2 allows remote attackers to execute arbitrary code via a long header beginning with "If: <http://" in a PROPFIND request, as exploited in the wild in July or August 2016.

Affected (1)

Products: Microsoft: Internet Information Services

1 product

Internet Information Services

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Microsoft Internet Information Services	Version 6.0

Running on/with	Platform Versions
Microsoft Windows Server 2003	Version r2

Related CWEs

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.

References (21)

http://www.securityfocus.com/bid/97127

Source: cve@mitre.org

Broken LinkThird Party AdvisoryVDB Entry

http://www.securitytracker.com/id/1038168

Source: cve@mitre.org

Broken LinkThird Party AdvisoryVDB Entry

https://0patch.blogspot.com/2017/03/0patching-immortal-cve-2017-7269.html

Source: cve@mitre.org

ExploitThird Party Advisory

https://github.com/danigargu/explodingcan

Source: cve@mitre.org

Exploit

https://github.com/edwardz246003/IIS_exploit

Source: cve@mitre.org

Broken LinkThird Party Advisory

https://github.com/rapid7/metasploit-framework/pull/8162

Source: cve@mitre.org

Issue TrackingPatch

https://medium.com/%40iraklis/number-of-internet-facing-vulnerable-iis-6-0-to-cve-2017-7269-8bd153ef5812

Source: cve@mitre.org

Exploit

https://support.microsoft.com/en-us/help/3197835/description-of-the-security-update-for-windows-xp-and-windows-server

Source: cve@mitre.org

Broken LinkPatchVendor Advisory

https://www.exploit-db.com/exploits/41738/

Source: cve@mitre.org

ExploitThird Party AdvisoryVDB Entry

https://www.exploit-db.com/exploits/41992/

Source: cve@mitre.org

ExploitThird Party AdvisoryVDB Entry

http://www.securityfocus.com/bid/97127

Source: af854a3a-2127-422b-91ae-364da2661108

Broken LinkThird Party AdvisoryVDB Entry

http://www.securitytracker.com/id/1038168

Source: af854a3a-2127-422b-91ae-364da2661108

Broken LinkThird Party AdvisoryVDB Entry

https://0patch.blogspot.com/2017/03/0patching-immortal-cve-2017-7269.html

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

https://github.com/danigargu/explodingcan

Source: af854a3a-2127-422b-91ae-364da2661108

Exploit

https://github.com/edwardz246003/IIS_exploit

Source: af854a3a-2127-422b-91ae-364da2661108

Broken LinkThird Party Advisory

https://github.com/rapid7/metasploit-framework/pull/8162

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingPatch

https://medium.com/%40iraklis/number-of-internet-facing-vulnerable-iis-6-0-to-cve-2017-7269-8bd153ef5812

Source: af854a3a-2127-422b-91ae-364da2661108

Exploit

https://support.microsoft.com/en-us/help/3197835/description-of-the-security-update-for-windows-xp-and-windows-server

Source: af854a3a-2127-422b-91ae-364da2661108

Broken LinkPatchVendor Advisory

https://www.exploit-db.com/exploits/41738/

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party AdvisoryVDB Entry

https://www.exploit-db.com/exploits/41992/

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party AdvisoryVDB Entry

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-7269

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

US Government Resource

Timeline

No history available yet.