Over 8.3 million live websites using IIS 6.0 are affected by a Zero
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2017-7269 | Buffer Overflow in Microsoft IIS 6.0 via WebDAV PROPFIND Header CVE-2017-7269 is a buffer overflow (CWE-119) in Internet Information Services (IIS) 6.0, the web server shipped with Microsoft Windows Server 2003 R2. A remote attacker triggers it by sending a WebDAV PROPFIND request whose overly long header begins with 'If: <http://', overflowing a buffer during header parsing. Successful exploitation allows remote code execution on the affected web server, giving the attacker control of the host at the web service's privilege level. Only organizations still running IIS 6.0 on Windows Server 2003 R2 are affected, typically legacy web servers, since that OS reached end of support in July 2015. The flaw is in CISA's Known Exploited Vulnerabilities catalog (added 2021-11-03) and carries a 99.8% EPSS score (100th percentile), indicating active in-the-wild exploitation; no public PoC is recorded in this data and, because the OS is out of support, no generally distributed patch exists. Do: Inventory internet-facing systems still running IIS 6.0 on Windows Server 2003 R2 and prioritize migration to a supported Windows/IIS version, since no general patch was released for this out-of-support product (custom-support customers may be able to obtain a hotfix from Microsoft). As interim mitigation, disable WebDAV if it is not needed, or block or limit PROPFIND requests and long 'If' headers via IIS request filtering, a reverse proxy, or a WAF. Per the KEV entry, apply updates per vendor instructions; ransomware association is currently unknown. | 9.8 | 100% | KEV PoC ×5 |
| largetens of thousands of internet-exposed IIS 6.0 servers today (hundreds of thousands at the 2017 disclosure) |
Full article447 words · extracted from securityaffairs.com · click to collapse
Millions of websites are affected by a buffer overflow zero-day vulnerability, tracked as CVE-2017-7269, that resides in the IIS 6.0.
The II6 6.0 zero-day flaw was discovered by two researchers with the Information Security Lab & School of Computer Science & Engineering, South China University of Technology Guangzhou, China who published a PoC code exploit on GitHub.
Microsoft has already acknowledged the vulnerability that was exploited in the wild in July or August 2016.
More than 8 million websites could be affected by the flaw that resides in the ScStoragePathFromUrl function of the Web Distributed Authoring and Versioning (WebDAV) service in Windows Server 2003 R2’s IIS 6.0.
The issue is caused by the improper validation of an ‘IF’ header in a PROPFIND request and could allow an attacker to trigger a denial of service condition or to run arbitrary code.
“Microsoft Internet Information Services (IIS) 6.0 is vulnerable to a zero-day Buffer Overflow vulnerability (CVE-2017-7269) due to an improper validation of an ‘IF’ header in a PROPFIND request.” reads the analysis published by Trend Micro.
“A remote attacker could exploit this vulnerability in the IIS WebDAV Component with a crafted request using PROPFIND method. Successful exploitation could result in denial of service condition or arbitrary code execution in the context of the user running the application.”
The Web Distributed Authoring and Versioning (WebDAV) extension of the HTTP protocol allows clients to perform remote Web content authoring operations. It allows to extend the support HTTP methods, including COPY, LOCK, MKCOL, PROPFIND, and UNLOCK.
“This vulnerability is exploited using the PROPFIND method and IF header. The PROPFIND method retrieves properties defined on the resource identified by the Request-URI. All the WebDAV-Compliant resources must support the PROPFIND method.” continues the analysis.
The impact of this vulnerability is wide, according to data provided by the W3Techs, Microsoft’s IIS is currently the third most popular web server solution in the wild (11.4% of all websites). IIS 6.0 accounts for 11.3%, roughly 1.3% of all websites on the Internet.
The vulnerability doesn’t affect newer versions of Microsoft Internet Information Services.
According to BuiltWith, IS 6.0 version is currently used by 2.3% of the entire Internet, over 8.3 million live websites are using IIS 6.0.
In order to mitigate the risk of cyber attacks, it is possible to disable the WebDAV service on IIS 6.0 installations.
“To mitigate the risk, disabling the WebDAV service on the vulnerable IIS 6.0 installation is recommended. Newer versions of Windows Server shipped with newer versions of IIS are not affected by this vulnerability.” concluded Trend Micro.
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(Security Affairs – IIS 6.0 flaw, hacking)
[adrotate banner=”5″]
[adrotate banner=”13″]
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/57513/hacking/iis-6-0-zero-day.html