CVE-2017-7269

Опубликовано: 27 мар. 2017

Источник: nvd

CVSS3: 9.8

CVSS2: 10

EPSS Критический

Описание

Buffer overflow in the ScStoragePathFromUrl function in the WebDAV service in Internet Information Services (IIS) 6.0 in Microsoft Windows Server 2003 R2 allows remote attackers to execute arbitrary code via a long header beginning with "If: <http://" in a PROPFIND request, as exploited in the wild in July or August 2016.

Ссылки

http://www.securityfocus.com/bid/97127
Broken Link
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id/1038168
Broken Link
Third Party Advisory
VDB Entry
https://0patch.blogspot.com/2017/03/0patching-immortal-cve-2017-7269.html
Exploit
Third Party Advisory
https://github.com/danigargu/explodingcan
Exploit
https://github.com/edwardz246003/IIS_exploit
Broken Link
Third Party Advisory
https://github.com/rapid7/metasploit-framework/pull/8162
Issue Tracking
Patch
https://medium.com/%40iraklis/number-of-internet-facing-vulnerable-iis-6-0-to-cve-2017-7269-8bd153ef5812
Exploit
https://support.microsoft.com/en-us/help/3197835/description-of-the-security-update-for-windows-xp-and-windows-server
Broken Link
Patch
Vendor Advisory
https://www.exploit-db.com/exploits/41738/
Exploit
Third Party Advisory
VDB Entry
https://www.exploit-db.com/exploits/41992/
Exploit
Third Party Advisory
VDB Entry
http://www.securityfocus.com/bid/97127
Broken Link
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id/1038168
Broken Link
Third Party Advisory
VDB Entry
https://0patch.blogspot.com/2017/03/0patching-immortal-cve-2017-7269.html
Exploit
Third Party Advisory
https://github.com/danigargu/explodingcan
Exploit
https://github.com/edwardz246003/IIS_exploit
Broken Link
Third Party Advisory
https://github.com/rapid7/metasploit-framework/pull/8162
Issue Tracking
Patch
https://medium.com/%40iraklis/number-of-internet-facing-vulnerable-iis-6-0-to-cve-2017-7269-8bd153ef5812
Exploit
https://support.microsoft.com/en-us/help/3197835/description-of-the-security-update-for-windows-xp-and-windows-server
Broken Link
Patch
Vendor Advisory
https://www.exploit-db.com/exploits/41738/
Exploit
Third Party Advisory
VDB Entry
https://www.exploit-db.com/exploits/41992/
Exploit
Third Party Advisory
VDB Entry

Уязвимые конфигурации

Конфигурация 1

Одновременно

cpe:2.3:a:microsoft:internet_information_services:6.0:*:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_server_2003:r2:*:*:*:*:*:*:*

EPSS

Процентиль: 100%

0.94429

Критический

9.8 Critical

CVSS3

10 Critical

CVSS2

Дефекты

CWE-120

Связанные уязвимости

GHSA-fj79-76j8-9vjm

CVSS3: 9.8

github

больше 3 лет назад

BDU:2017-00750

fstec

почти 9 лет назад

Уязвимость пакета сетевых служб Internet Information Services, позволяющая нарушителю выполнить произвольный код