Actively exploited zero-day in IIS 6.0 affects 60,000+ servers
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2017-7269 | Buffer Overflow in Microsoft IIS 6.0 via WebDAV PROPFIND Header CVE-2017-7269 is a buffer overflow (CWE-119) in Internet Information Services (IIS) 6.0, the web server shipped with Microsoft Windows Server 2003 R2. A remote attacker triggers it by sending a WebDAV PROPFIND request whose overly long header begins with 'If: <http://', overflowing a buffer during header parsing. Successful exploitation allows remote code execution on the affected web server, giving the attacker control of the host at the web service's privilege level. Only organizations still running IIS 6.0 on Windows Server 2003 R2 are affected, typically legacy web servers, since that OS reached end of support in July 2015. The flaw is in CISA's Known Exploited Vulnerabilities catalog (added 2021-11-03) and carries a 99.8% EPSS score (100th percentile), indicating active in-the-wild exploitation; no public PoC is recorded in this data and, because the OS is out of support, no generally distributed patch exists. Do: Inventory internet-facing systems still running IIS 6.0 on Windows Server 2003 R2 and prioritize migration to a supported Windows/IIS version, since no general patch was released for this out-of-support product (custom-support customers may be able to obtain a hotfix from Microsoft). As interim mitigation, disable WebDAV if it is not needed, or block or limit PROPFIND requests and long 'If' headers via IIS request filtering, a reverse proxy, or a WAF. Per the KEV entry, apply updates per vendor instructions; ransomware association is currently unknown. | 9.8 | 100% | KEV PoC ×5 |
| largetens of thousands of internet-exposed IIS 6.0 servers today (hundreds of thousands at the 2017 disclosure) |
Full article351 words · extracted from helpnetsecurity.com · click to collapse
Microsoft Internet Information Services (IIS) 6.0 sports a zero-day vulnerability (CVE-2017-7269) that was exploited in the wild last summer and is likely also being exploited by threat actors at this very moment.
It is a buffer overflow flaw in a function in the WebDAV service in IIS 6.0 in Microsoft Windows Server 2003 R2, and can be triggered by attackers sending a overlong IF header in a PROPFIND request.
Unfortunately, the flaw won’t be patched by Microsoft, because they stopped supporting Windows Server 2003 a few years ago (IIS 6.0 was included in the OS).
Shodan shows that there are a little over 600,000 publicly accessible IIS 6.0 servers on the Internet, and most of them are probably running on Windows Server 2003. Of these, a good 10 percent has WebDAV enabled to allow for remote web authoring, meaning that there are possibly millions of websites out there exposed to this exploit.
So what can be done about CVE-2017-7269?
The risk of exploitation can be mitigated by disabling the WebDAV service on the vulnerable IIS 6.0 installation, but not all administrators will want to do it.
Mitja Kolsek, CEO of Acros Security and co-founder at 0patch, offers another solution: a micropatch that should plug the hole.
The patch is free, and its source code open for inspection (you can view it here). For it to be delivered to the vulnerable machine admins will need to download and install a copy of the company’s 0patch Agent.
More technical details about the flaw can be found in this post by Trend Micro researchers, but the most important things to know right now are as follows:
- The flaw can be exploited remotely, and allows attackers to execute arbitrary code on a vulnerable machine
- A proof-of-concept exploit has been published on GitHub, so it’s highly likely that it is being repurposed by attackers and will be used soon (if it’s not already)
- The flaw affects 32-bit and 64-bit Windows Server 2003 with WebDAV functionality enabled. It doesn’t affect newer versions of IIS (7.0 or later) and newer versions of Windows Server.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2017/03/30/cve-2017-7269/