CVE-2017-7269

Katalog CVE

CVSS 9.8 · Critical KEV · sudah dieksploitasi EPSS 99,8%

Kerentanan Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') pada microsoft internet information services. Skor CVSS 3.1 9.8 (Critical) menurut NVD. Masuk katalog KEV CISA pada 3 November 2021, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

Buffer overflow in the ScStoragePathFromUrl function in the WebDAV service in Internet Information Services (IIS) 6.0 in Microsoft Windows Server 2003 R2 allows remote attackers to execute arbitrary code via a long header beginning with "If: <http://" in a PROPFIND request, as exploited in the wild in July or August 2016.

Rincian

Terbit di NVD

27 Maret 2017

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

EPSS (30 hari)

99,8% peluang dieksploitasi; lebih tinggi dari 99,9% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama

Microsoft Windows Server Buffer Overflow Vulnerability

Masuk KEV

3 November 2021

Tenggat CISA

3 Mei 2022 (untuk instansi federal AS)

Ransomware

Belum tercatat

Tindakan wajib

Apply updates per vendor instructions.

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://support.microsoft.com/en-us/help/3197835/description-of-the-security-update-for-windows-xp-and-windows... broken link · patch · advisory vendor
• https://github.com/rapid7/metasploit-framework/pull/8162 issue tracking · patch
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-7269 pemerintah AS
• http://www.securityfocus.com/bid/97127 broken link · advisory pihak ketiga · vdb entry
• http://www.securitytracker.com/id/1038168 broken link · advisory pihak ketiga · vdb entry
• https://0patch.blogspot.com/2017/03/0patching-immortal-cve-2017-7269.html exploit · advisory pihak ketiga
• https://github.com/edwardz246003/IIS_exploit broken link · advisory pihak ketiga
• https://www.exploit-db.com/exploits/41738/ exploit · advisory pihak ketiga · vdb entry
• https://www.exploit-db.com/exploits/41992/ exploit · advisory pihak ketiga · vdb entry
• https://github.com/danigargu/explodingcan exploit
• https://medium.com/%40iraklis/number-of-internet-facing-vulnerable-iis-6-0-to-cve-2017-7269-8bd153ef5812 exploit