Buffer overflow in the ScStoragePathFromUrl function in the WebDAV service in Internet Information Services (IIS) 6.0 in Microsoft Windows Server 2003 R2 allows remote malicious users to execute arbitrary code via a long header beginning with "If: <" in a PROPFIND request, as exploited in the wild in July or August 2016.
| Vulnerable Product | Search on Vulmon | Subscribe to Product |
|---|---|---|
microsoft internet_information_server 6.0 |
According to KSN data, Kaspersky Lab solutions detected and repelled 277,646,376 malicious attacks from online resources located in 185 countries all over the world. 72,012,219 unique URLs were recognized as malicious by web antivirus components. Attempted infections by malware that aims to steal money via online access to bank accounts were registered on 204,388 user computers. Crypto ransomware attacks were blocked on 186283 computers of unique users. Kaspersky Lab’s file antivirus detected ...
Suggested workaround for exploited flaw: Upgrade to a non-EoL operating system
Microsoft will not patch a critical security hole recently found and exploited in IIS 6 on Windows Server 2003 R2 – the operating system it stopped supporting roughly two years ago. The buffer overflow bug can be exploited to inject malicious code into a vulnerable machine and execute it, allowing an attacker to gain control of the computer. It requires WebDAV to be enabled. If you have such a machine exposed to or reachable from the internet, and you get hacked, maybe you deserve it. On Monda...
Vulmon