Actively exploited · Published Mar 27, 2017 · Assigned by mitre
CVE-2017-7269
Critical 9.8 Exploited
In plain English
A critical-severity buffer overflow in Internet Information Services (IIS) from Microsoft. Attackers are actively exploiting it in the wild (listed by CISA on November 3, 2021). The chance it is exploited in the next 30 days is estimated at 99.8% (higher than 99.9% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, Nuclei, public proof-of-concept code. Apply updates per vendor instructions.
CISA guidance
Apply updates per vendor instructions.
Federal agencies must remediate by May 3, 2022.
Official description
Buffer overflow in the ScStoragePathFromUrl function in the WebDAV service in Internet Information Services (IIS) 6.0 in Microsoft Windows Server 2003 R2 allows remote attackers to execute arbitrary code via a long header beginning with "If: <http://" in a PROPFIND request, as exploited in the wild in July or August 2016.
Affected products (as reported)
Weakness: CWE-120 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- 41992 exploit, x_refsource_EXPLOIT-DB
- 97127 vdb-entry, x_refsource_BID
- https://medium.com/%40iraklis/number-of-internet-facing-vulnerable-iis-6-0-to-cve-2017-7269-8bd153ef5812 x_refsource_MISC
- https://github.com/rapid7/metasploit-framework/pull/8162 x_refsource_MISC
- https://github.com/danigargu/explodingcan x_refsource_MISC
- 1038168 vdb-entry, x_refsource_SECTRACK
- 41738 exploit, x_refsource_EXPLOIT-DB
- https://support.microsoft.com/en-us/help/3197835/description-of-the-security-update-for-windows-xp-and-windows-server x_refsource_CONFIRM
- https://0patch.blogspot.com/2017/03/0patching-immortal-cve-2017-7269.html x_refsource_MISC
- https://github.com/edwardz246003/IIS_exploit x_refsource_MISC
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-7269 government-resource