← Retour aux CVEs

CVE-2017-7269

CRITICALCISA KEV

9.8

Description

Buffer overflow in the ScStoragePathFromUrl function in the WebDAV service in Internet Information Services (IIS) 6.0 in Microsoft Windows Server 2003 R2 allows remote attackers to execute arbitrary code via a long header beginning with "If: <http://" in a PROPFIND request, as exploited in the wild in July or August 2016.

Details CVE

Score CVSS v3.19.8

SeveriteCRITICAL

Vecteur CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Vecteur d'attaqueNETWORK

ComplexiteLOW

Privileges requisNONE

Interaction utilisateurNONE

Publie3/27/2017

Derniere modification4/21/2026

Sourcekev

Observations honeypot0

CISA KEV

FournisseurMicrosoft

ProduitInternet Information Services (IIS)

Nom vulnerabiliteMicrosoft Windows Server Buffer Overflow Vulnerability

Date ajout KEV2021-11-03

Date limite remediation2022-05-03

Utilise dans ransomwareUnknown

Produits affectes

microsoft:internet_information_servicesmicrosoft:windows_server_2003

Faiblesses (CWE)

CWE-120CWE-120

References

http://www.securityfocus.com/bid/97127(cve@mitre.org)

http://www.securitytracker.com/id/1038168(cve@mitre.org)

https://0patch.blogspot.com/2017/03/0patching-immortal-cve-2017-7269.html(cve@mitre.org)

https://github.com/danigargu/explodingcan(cve@mitre.org)

https://github.com/edwardz246003/IIS_exploit(cve@mitre.org)

https://github.com/rapid7/metasploit-framework/pull/8162(cve@mitre.org)

https://medium.com/%40iraklis/number-of-internet-facing-vulnerable-iis-6-0-to-cve-2017-7269-8bd153ef5812(cve@mitre.org)

https://support.microsoft.com/en-us/help/3197835/description-of-the-security-update-for-windows-xp-and-windows-server(cve@mitre.org)

https://www.exploit-db.com/exploits/41738/(cve@mitre.org)

https://www.exploit-db.com/exploits/41992/(cve@mitre.org)

http://www.securityfocus.com/bid/97127(af854a3a-2127-422b-91ae-364da2661108)

http://www.securitytracker.com/id/1038168(af854a3a-2127-422b-91ae-364da2661108)

https://0patch.blogspot.com/2017/03/0patching-immortal-cve-2017-7269.html(af854a3a-2127-422b-91ae-364da2661108)

https://github.com/danigargu/explodingcan(af854a3a-2127-422b-91ae-364da2661108)

https://github.com/edwardz246003/IIS_exploit(af854a3a-2127-422b-91ae-364da2661108)

https://github.com/rapid7/metasploit-framework/pull/8162(af854a3a-2127-422b-91ae-364da2661108)

https://medium.com/%40iraklis/number-of-internet-facing-vulnerable-iis-6-0-to-cve-2017-7269-8bd153ef5812(af854a3a-2127-422b-91ae-364da2661108)

https://support.microsoft.com/en-us/help/3197835/description-of-the-security-update-for-windows-xp-and-windows-server(af854a3a-2127-422b-91ae-364da2661108)

https://www.exploit-db.com/exploits/41738/(af854a3a-2127-422b-91ae-364da2661108)

https://www.exploit-db.com/exploits/41992/(af854a3a-2127-422b-91ae-364da2661108)

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-7269(134c704f-9b21-4f2e-91b3-4a467353bcc0)

Correlations IOC

Aucune correlation enregistree

This product uses data from the NVD API but is not endorsed or certified by the NVD.