CVE-2017-7269
published 2017-03-27CVE-2017-7269: Buffer overflow in the ScStoragePathFromUrl function in the WebDAV service in Internet Information Services (IIS) 6.0 in Microsoft Windows Server 2003 R2…
PriorityP195critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
KEVITWEXPLOITInitial access
CISA Known Exploited Vulnerabilitydue 2022-05-03
Exploited in the wild
EPSS
99.82%
100.0th percentile
Buffer overflow in the ScStoragePathFromUrl function in the WebDAV service in Internet Information Services (IIS) 6.0 in Microsoft Windows Server 2003 R2 allows remote attackers to execute arbitrary code via a long header beginning with "If: <http://" in a PROPFIND request, as exploited in the wild in July or August 2016.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | internet_information_services | — | — |
Detection & IOCsextracted from sources · hover to see the quote
other1008266 - Microsoft IIS WebDAV ScStoragePathFromUrl Buffer Overflow Vulnerability (CVE-2017-7269)↗
other87284 Microsoft Internet Information Services 6.0 Buffer Overflow Vulnerability – Shadow Brokers (EXPLODINGCAN)↗
- →Exploit targets the PROPFIND HTTP method with an overly long 'IF' header beginning with 'If: <http://' in a WebDAV request to IIS 6.0; detect PROPFIND requests with abnormally large IF headers on port 80/443. ↗
- ·CVE-2017-7269 only affects IIS 6.0 on Windows Server 2003 R2; newer IIS versions are not vulnerable. No patch is available from Microsoft as the OS is end-of-support; mitigation is to disable WebDAV. ↗
- ·In Operation Red Signature, the attacker's server (207.148.94.157) was configured to only serve malicious files to clients within specific target IP ranges; network-based detections may not trigger outside those ranges. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C
vulncheck9.8CRITICAL
cisa9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA
Microsoft Windows Server Buffer Overflow Vulnerability
cisa·2021-11-03·CVSS 9.8
CVE-2017-7269 [CRITICAL] CWE-119 Microsoft Windows Server Buffer Overflow Vulnerability
Vulnerability: Microsoft Windows Server Buffer Overflow Vulnerability
Affected: Microsoft Internet Information Services (IIS)
Microsoft Windows Server 2003 R2 contains a buffer overflow vulnerability in Internet Information Services (IIS) 6.0 which allows remote attackers to execute code via a long header beginning with "If: <http://" in a PROPFIND request.
Required Action: Apply updates per vendor instructions.
Notes: https://nvd.nist.gov/vuln/detail/CVE-2017-7269
Remediation Due Date: 2022-05-03
GHSA
GHSA-fj79-76j8-9vjm: Buffer overflow in the ScStoragePathFromUrl function in the WebDAV service in Internet Information Services (IIS) 6
ghsa_unreviewed·2022-05-14
CVE-2017-7269 [CRITICAL] CWE-119 GHSA-fj79-76j8-9vjm: Buffer overflow in the ScStoragePathFromUrl function in the WebDAV service in Internet Information Services (IIS) 6
Buffer overflow in the ScStoragePathFromUrl function in the WebDAV service in Internet Information Services (IIS) 6.0 in Microsoft Windows Server 2003 R2 allows remote attackers to execute arbitrary code via a long header beginning with "If: <http://" in a PROPFIND request, as exploited in the wild in July or August 2016.
VulnCheck
Microsoft Windows Server Buffer Overflow Vulnerability
vulncheck·2017·CVSS 9.8
CVE-2017-7269 [CRITICAL] CWE-119 Microsoft Windows Server Buffer Overflow Vulnerability
Microsoft Windows Server Buffer Overflow Vulnerability
Microsoft Windows Server 2003 R2 contains a buffer overflow vulnerability in Internet Information Services (IIS) 6.0 which allows remote attackers to execute code via a long header beginning with "If: <http://" in a PROPFIND request.
Affected: Microsoft Internet Information Services (IIS)
Required Action: Apply updates per vendor instructions.
Exploitation References: https://www.cve.org/CVERecord?id=CVE-2017-7269; https://community.broadcom.com/symantecenterprise/communities/community-home/librarydocuments/viewdocument?DocumentKey=a9c54f79-d780-437b-a7f5-a74960e299d5&CommunityKey=8af7f28f-02f1-4107-8639-93a60b6546d4&tab=librarydocuments; https://documents.trendmicro.com/assets/appendix-following-the-trail-of-blacktechs-cyber-espio
Suricata
ET WEB_SERVER Microsoft IIS Remote Code Execution (CVE-2017-7269)
suricata·2017-03-28·CVSS 9.8
CVE-2017-7269 [CRITICAL] ET WEB_SERVER Microsoft IIS Remote Code Execution (CVE-2017-7269)
ET WEB_SERVER Microsoft IIS Remote Code Execution (CVE-2017-7269)
Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SERVER Microsoft IIS Remote Code Execution (CVE-2017-7269)"; flow:established,to_server; http.request_header; header_lowercase; content:"if|3a 20 3c|"; startswith; pcre:"/^if\x3a\x20\x3c[^\r\n>]+?(?:[\x7f-\xff])/i"; reference:url,github.com/edwardz246003/IIS_exploit/blob/master/exploit.py; classtype:attempted-user; sid:2024107; rev:5; metadata:affected_product Microsoft_IIS, attack_target Web_Server, created_at 2017_03_28, cve CVE_2017_7269, deployment Datacenter, performance_impact Low, signature_severity Major, tag CISA_KEV, updated_at 2024_04_28, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exp
YARA
HKTL_NET_NAME_cve_2017_7269_tool
yara
CVE-2017-7269 HKTL_NET_NAME_cve_2017_7269_tool
rule HKTL_NET_NAME_cve_2017_7269_tool {
meta:
description = "Detects .NET red/black-team tools via name"
reference = "https://github.com/zcgonvh/cve-2017-7269-tool"
author = "Arnim Rupp"
date = "2021-01-22"
strings:
$name = "cve-2017-7269-tool" ascii wide
$compile = "AssemblyTitle" ascii wide
condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
}
Exploit-DB
Microsoft IIS - WebDav 'ScStoragePathFromUrl' Remote Overflow (Metasploit)
exploitdb·2017-05-11
CVE-2017-7269 Microsoft IIS - WebDav 'ScStoragePathFromUrl' Remote Overflow (Metasploit)
Microsoft IIS - WebDav 'ScStoragePathFromUrl' Remote Overflow (Metasploit)
---
##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
class MetasploitModule ' Microsoft IIS WebDav ScStoragePathFromUrl Overflow',
'Description' => %q{
Buffer overflow in the ScStoragePathFromUrl function
in the WebDAV service in Internet Information Services (IIS) 6.0
in Microsoft Windows Server 2003 R2 allows remote attackers to
execute arbitrary code via a long header beginning with
"If:
[
'Zhiniang Peng', # Original author
'Chen Wu', # Original author
'Dominic Chell ', # metasploit module
'firefart', # metasploit module
'zcgonvh ', # metasploit module
'Rich Whitcroft' # metasploit module
],
'License' => MSF_LICENSE,
'Refer
Exploit-DB
Microsoft IIS 6.0 - WebDAV 'ScStoragePathFromUrl' Remote Buffer Overflow
exploitdb·2017-03-27
CVE-2017-7269 Microsoft IIS 6.0 - WebDAV 'ScStoragePathFromUrl' Remote Buffer Overflow
Microsoft IIS 6.0 - WebDAV 'ScStoragePathFromUrl' Remote Buffer Overflow
---
'''
Description:Buffer overflow in the ScStoragePathFromUrl function in the WebDAV service in Internet Information Services (IIS) 6.0 in Microsoft Windows Server 2003 R2 allows remote attackers to execute arbitrary code via a long header beginning with "If: '
pay+=' (Not ) \r\n\r\n'
print pay
sock.send(pay)
data = sock.recv(80960)
print data
sock.close
Metasploit
Microsoft IIS WebDav ScStoragePathFromUrl Overflow
metasploit
Microsoft IIS WebDav ScStoragePathFromUrl Overflow
Microsoft IIS WebDav ScStoragePathFromUrl Overflow
Buffer overflow in the ScStoragePathFromUrl function in the WebDAV service in Internet Information Services (IIS) 6.0 in Microsoft Windows Server 2003 R2 allows remote attackers to execute arbitrary code via a long header beginning with "If: <http://" in a PROPFIND request, as exploited in the wild in July or August 2016. Original exploit by Zhiniang Peng and Chen Wu.
Nuclei
Windows Server 2003 & IIS 6.0 - Remote Code Execution
nuclei·CVSS 9.8
CVE-2017-7269 [CRITICAL] Windows Server 2003 & IIS 6.0 - Remote Code Execution
Windows Server 2003 & IIS 6.0 - Remote Code Execution
Internet Information Services (IIS) 6.0 in Microsoft Windows Server 2003 R2 contains a buffer overflow vulnerability in the ScStoragePathFromUrl function in the WebDAV service that could allow remote attackers to execute arbitrary code via a long header beginning with "If ", dasl)
- regex("[\d]+(,\s+[\d]+)?", dav)
- regex(".*?PROPFIND", public)
- regex(".*?PROPFIND", allow)
condition: or
- type: word
part: header
words:
- "IIS/6.0"
- type: status
status:
- 200
# digest: 4a0a0047304502200a40d5d188930120acba8f945dd91566ea439dc84ce01c81a0f9b50b703187b6022100d55d01d8a6a7b4ef67b51342aab720f8e158a63394665ce59e80d28783604c14:922c64590222798bb761d5b6d8e72950
Qualys
Managing CISA Known Exploited Vulnerabilities with Qualys VMDR | Qualys
blogs_qualys·2022-02-23
Managing CISA Known Exploited Vulnerabilities with Qualys VMDR | Qualys
#### Table of Contents
- Situation
- Directive Scope
- CISA Catalog of Known Exploited Vulnerabilities
- Detect CISA Vulnerabilities Using Qualys VMDR
- CISA Exploited RTI
- Detailed Operational Dashboard
- Remediation
- Federal Enterprises and Agencies Can Act Now
- Summary
- Getting Started
CISA released a directive in November 2021, recommending urgent and prioritized remediation of actively exploited vulnerabilities. Both government agencies and corporations should heed this advice. This blog outlines how Qualys Vulnerability Management, Detection & Response can be used by any organization to respond to this directive efficiently and effectively.
## Situation
Last November 2021, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) released a Binding Operational Directiv
Securelist
Operation TunnelSnake
blogs_securelist·2021-05-06
Operation TunnelSnake
Table of Contents
- What is the Moriya rootkit and how does it work?
- How were targeted servers initially infected?
- Post exploitation toolset
- IISSpy: tracing Moriya back to a user-mode rootkit
- The ProcessKiller rootkit vs. security products
- What do we know about the threat actor?
- Who were the targets?
- Conclusion
- IOCs
Authors
- Mark Lechtik
- Giampaolo Dedola
## Formerly unknown rootkit used to secretly control networks of regional organizations
Windows rootkits, especially those operating in kernel space, are pieces of malware infamous for their near absolute power in the operating system. Usually deployed as drivers, such implants have high privileges in the system, allowing them to intercept and potentially tamper with core I/O operations conducted by the underlying
Securelist
Operation TunnelSnake
blogs_securelist·2021-05-06
Operation TunnelSnake
Table of Contents
What is the Moriya rootkit and how does it work?
User mode agent analysis
Kernel mode driver analysis
How were targeted servers initially infected?
Post exploitation toolset
IISSpy: tracing Moriya back to a user-mode rootkit
The ProcessKiller rootkit vs. security products
What do we know about the threat actor?
Who were the targets?
Conclusion
IOCs
Authors
Mark Lechtik
Giampaolo Dedola
## Formerly unknown rootkit used to secretly control networks of regional organizations
Windows rootkits, especially those operating in kernel space, are pieces of malware infamous for their near absolute power in the operating system. Usually deployed as drivers, such implants have high privileges in the system, allowing them to intercept and potentially tamper with core I/
Trendmicro
Operation Red Signature Targets South Korean Companies
blogs_trendmicro·2018-08-21·CVSS 9.8
[CRITICAL] Operation Red Signature Targets South Korean Companies
APT und gezielte Angriffe
## Operation Red Signature Targets South Korean Companies
We uncovered Operation Red Signature, an information theft-driven supply chain attack targeting organizations in South Korea. We discovered the attacks around the end of July, while the media reported the attack in South Korea on August 6.
By: Jaromir Horejsi, Joseph C Chen, Kawabata Kohei, Kenney Lu Aug 21, 2018 Read time: ( words)
Save to Folio
Together with our colleagues at IssueMakersLab , we uncovered Operation Red Signature, an information theft-driven supply chain attack targeting organizations in South Korea. We discovered the attacks around the end of July, while the media reported the attack in South Korea on August 6.
The threat actors compromised the update server of a remote support solu
Trendmicro
Operation Red Signature Targets South Korean Companies
blogs_trendmicro·2018-08-21·CVSS 9.8
[CRITICAL] Operation Red Signature Targets South Korean Companies
APT & Targeted Attacks
## Operation Red Signature Targets South Korean Companies
We uncovered Operation Red Signature, an information theft-driven supply chain attack targeting organizations in South Korea. We discovered the attacks around the end of July, while the media reported the attack in South Korea on August 6.
By: Jaromir Horejsi, Joseph C Chen, Kawabata Kohei, Kenney Lu Aug 21, 2018 Read time: ( words)
Save to Folio
Together with our colleagues at IssueMakersLab , we uncovered Operation Red Signature, an information theft-driven supply chain attack targeting organizations in South Korea. We discovered the attacks around the end of July, while the media reported the attack in South Korea on August 6.
The threat actors compromised the update server of a remote support solutio
Trendmicro
Operation Red Signature Targets South Korean Companies
blogs_trendmicro·2018-08-21·CVSS 9.8
[CRITICAL] Operation Red Signature Targets South Korean Companies
APT y ataques dirigidos
## Operation Red Signature Targets South Korean Companies
We uncovered Operation Red Signature, an information theft-driven supply chain attack targeting organizations in South Korea. We discovered the attacks around the end of July, while the media reported the attack in South Korea on August 6.
By: Jaromir Horejsi, Joseph C Chen, Kawabata Kohei, Kenney Lu Aug 21, 2018 Read time: ( words)
Save to Folio
Together with our colleagues at IssueMakersLab , we uncovered Operation Red Signature, an information theft-driven supply chain attack targeting organizations in South Korea. We discovered the attacks around the end of July, while the media reported the attack in South Korea on August 6.
The threat actors compromised the update server of a remote support soluti
Trendmicro
Operation Red Signature Targets South Korean Companies
blogs_trendmicro·2018-08-21·CVSS 9.8
[CRITICAL] Operation Red Signature Targets South Korean Companies
APT & Targeted Attacks
## Operation Red Signature Targets South Korean Companies
We uncovered Operation Red Signature, an information theft-driven supply chain attack targeting organizations in South Korea. We discovered the attacks around the end of July, while the media reported the attack in South Korea on August 6.
By: Jaromir Horejsi, Joseph C Chen, Kawabata Kohei, Kenney Lu 2018/08/21 Read time: ( words)
Save to Folio
Together with our colleagues at IssueMakersLab , we uncovered Operation Red Signature, an information theft-driven supply chain attack targeting organizations in South Korea. We discovered the attacks around the end of July, while the media reported the attack in South Korea on August 6.
The threat actors compromised the update server of a remote support solutions
Trendmicro
Operation Red Signature Targets South Korean Companies
blogs_trendmicro·2018-08-21·CVSS 9.8
[CRITICAL] Operation Red Signature Targets South Korean Companies
APT & Targeted Attacks
# Operation Red Signature Targets South Korean Companies
We uncovered Operation Red Signature, an information theft-driven supply chain attack targeting organizations in South Korea. We discovered the attacks around the end of July, while the media reported the attack in South Korea on August 6.
By: Jaromir Horejsi, Joseph C Chen, Kawabata Kohei, Kenney Lu
2018/08/21
Read time: ( words)
Save to Folio
Together with our colleagues at IssueMakersLab, we uncovered Operation Red Signature, an information theft-driven supply chain attack targeting organizations in South Korea. We discovered the attacks around the end of July, while the media reported the attack in South Korea on August 6.
The threat actors compromised the update server of a remote support solutions
Fortinet
Buffer Overflow Attack Targeting Microsoft IIS 6.0 Returns
blogs_fortinet·2018-05-23·CVSS 9.8
CVE-2017-7269 [CRITICAL] Buffer Overflow Attack Targeting Microsoft IIS 6.0 Returns
FORTIGUARD LABS THREAT RESEARCH
Buffer Overflow Attack Targeting Microsoft IIS 6.0 Returns
By Bing Liu | May 23, 2018
There is a buffer overflow vulnerability in the WebDAV service in Microsoft IIS 6.0 identified as CVE-2017-7269 that allows remote attackers to execute arbitrary code via a long HTTP header. This vulnerability was reportedly first exploited in July or August of 2016, and the PoC was publicly disclosed in March 2017 on GitHub. Over the past month, however, FortiGuard Labs has been documenting a spike in new attacks targeting this vulnerability, peaking on Apr 13, 2018 when we logged over 4 million triggers.
Fortinet released an IPS signature for this vulnerability in March of 2017 named MS.IIS.WebDAV.PROPFIND.ScStoragePathFromUrl.Buffer.Overflow. The daily trigger rate of
Securelist
IT threat evolution Q3 2017. Statistics
blogs_securelist·2017-11-10
IT threat evolution Q3 2017. Statistics
Table of Contents
Q3 figures
Mobile threats
Q3 events
The spread of the Asacub banker
New capabilities of mobile banking Trojans
The growth of WAP billing subscriptions
Mobile threat statistics
Distribution of mobile malware by type
TOP 20 mobile malware programs
The geography of mobile threats
Mobile banking Trojans
Mobile ransomware
Vulnerable apps exploited by cybercriminals
Online threats (Web-based attacks)
Online threats in the banking sector
Geography of attacks
TOP 10 banking malware families
Cryptoware programs
Q3 highlights
Crysis rises from the dead
Surge in Cryrar attacks
Master key to original versions of Petya/Mischa/GoldenEye published
The number of new modifications
The number of users attacked by ransomware
The geography of attacks
Top 10 countrie
Securelist
IT threat evolution Q3 2017. Statistics
blogs_securelist·2017-11-10
IT threat evolution Q3 2017. Statistics
Table of Contents
- Q3 figures
- Mobile threats
- Vulnerable apps exploited by cybercriminals
- Online threats (Web-based attacks)
- Local threats
Authors
- Roman Unuchek
- Fedor Sinitsyn
- Denis Parinov
- Alexander Liskin
## Q3 figures
According to KSN data, Kaspersky Lab solutions detected and repelled 277,646,376 malicious attacks from online resources located in 185 countries all over the world.
72,012,219 unique URLs were recognized as malicious by web antivirus components.
Attempted infections by malware that aims to steal money via online access to bank accounts were registered on 204,388 user computers.
Crypto ransomware attacks were blocked on 186283 computers of unique users.
Kaspersky Lab’s file antivirus detected a total of 198,228,428 unique malicious and potentially
Trendmicro
The Trail of BlackTech’s Cyber Espionage Campaigns
blogs_trendmicro·2017-06-22·CVSS 9.8
[CRITICAL] The Trail of BlackTech’s Cyber Espionage Campaigns
# The Trail of BlackTech’s Cyber Espionage Campaigns
Following the activities and evolving tactics of cyberespionage group BlackTech helped us uncover the proverbial red string of fate that connected three seemingly disparate campaigns: PLEAD, Shrouded Crossbow, and of late, Waterbear.
By: Lenart Bermejo, Razor Huang, CH Lei
2017/06/22
Read time: ( words)
Save to Folio
BlackTech is a cyber espionage group operating against targets in East Asia, particularly Taiwan, and occasionally, Japan and Hong Kong. Based on the mutexes and domain names of some of their C&C servers, BlackTech’s campaigns are likely designed to steal their target’s technology.
Following their activities and evolving tactics and techniques helped us uncover the proverbial red string of fate that connected three see
Qualys
Microsoft Fixes 94 Security Issues in Massive June Update | Qualys
blogs_qualys·2017-06-13·CVSS 8.1
[HIGH] Microsoft Fixes 94 Security Issues in Massive June Update | Qualys
Today Microsoft released patches to fix 94 vulnerabilities out of which 27 fix remote code execution issues which can allow an attackers to remotely take control of victim machines. This is a massive update and fixes more than double the number of vulnerabilities as compared to the last two months.
Microsoft also released Security Advisory 4025685 which includes patches for older platforms due to heightened risk of exploitation. In my opinion this should be treated as a blue-print for future attacks and updates for EOL operating systems should be applied as soon as possible. Older platforms include Windows XP, Windows Server 2003, Vista and Windows 8 and older issues like MS08-067, MS09-050, MS10-061, MS14-068, MS17-010, MS17-013 are patched. Newer issues affecting older platforms like CV
Qualys
Microsoft Fixes 94 Security Issues in Massive June Update
blogs_qualys·2017-06-13·CVSS 8.1
[HIGH] Microsoft Fixes 94 Security Issues in Massive June Update
Today Microsoft released patches to fix 94 vulnerabilities out of which 27 fix remote code execution issues which can allow an attackers to remotely take control of victim machines. This is a massive update and fixes more than double the number of vulnerabilities as compared to the last two months.
Microsoft also released Security Advisory 4025685 which includes patches for older platforms due to heightened risk of exploitation. In my opinion this should be treated as a blue-print for future attacks and updates for EOL operating systems should be applied as soon as possible. Older platforms include Windows XP, Windows Server 2003, Vista and Windows 8 and older issues like MS08-067, MS09-050, MS10-061, MS14-068, MS17-010, MS17-013 are patched. Newer issues affecting older platforms like CV
Qualys
The Shadow Brokers Release Zero Day Exploit Tools | Qualys
blogs_qualys·2017-04-15·CVSS 8.8
[HIGH] The Shadow Brokers Release Zero Day Exploit Tools | Qualys
On Friday, a hacker group known as The Shadow Brokers publicly released a large number of functional exploit tools. Several of these tools make use of zero-day vulnerabilities, most of which are in Microsoft Windows. Exploiting these vulnerabilities in many cases leads to remote code execution and full system access.
Both end-of-support and current Windows versions are impacted, including Windows 2003, XP, Vista, 7, 2008, 8, and 2012. Microsoft has released patches for each vulnerability across all supported platforms, but will not be releasing patches for end-of-support versions of Windows. It is highly recommended that any end-of-support Windows systems be replaced or isolated, as these systems will often be impacted by new vulnerabilities, without the availability of a patch.
For zero
Qualys
The Shadow Brokers Release Zero Day Exploit Tools
blogs_qualys·2017-04-15·CVSS 8.8
[HIGH] The Shadow Brokers Release Zero Day Exploit Tools
On Friday, a hacker group known as The Shadow Brokers publicly released a large number of functional exploit tools. Several of these tools make use of zero-day vulnerabilities, most of which are in Microsoft Windows. Exploiting these vulnerabilities in many cases leads to remote code execution and full system access.
Both end-of-support and current Windows versions are impacted, including Windows 2003, XP, Vista, 7, 2008, 8, and 2012. Microsoft has released patches for each vulnerability across all supported platforms, but will not be releasing patches for end-of-support versions of Windows. It is highly recommended that any end-of-support Windows systems be replaced or isolated, as these systems will often be impacted by new vulnerabilities, without the availability of a patch.
For zero
Qualys
Microsoft IIS 6.0 Buffer Overflow Zero Day
blogs_qualys·2017-04-01·CVSS 9.8
CVE-2017-7269 [CRITICAL] Microsoft IIS 6.0 Buffer Overflow Zero Day
A new zero-day vulnerability ( CVE-2017-7269 ) impacting Microsoft IIS 6.0 has been announced with proof-of-concept code . This vulnerability can only be exploited if WebDAV is enabled. IIS 6.0 is a component of Microsoft Windows Server 2003 (including R2.) Microsoft has ended support for Server 2003 on July 14, 2015, which means that this vulnerability will most likely not be patched. It is recommended that these systems be upgraded to a supported platform. The current workaround is to disable the WebDAV Web Service Extension if it is not needed by any web applications.
The Qualys Cloud Platform can help you detect the vulnerability, track and manage Server 2003 Assets, as well as block exploits against web-based vulnerabilities like this one.
## Detecting the Vulnerability
Qualys has
Qualys
Microsoft IIS 6.0 Buffer Overflow Zero Day | Qualys
blogs_qualys·2017-04-01·CVSS 9.8
CVE-2017-7269 [CRITICAL] Microsoft IIS 6.0 Buffer Overflow Zero Day | Qualys
A new zero-day vulnerability (CVE-2017-7269) impacting Microsoft IIS 6.0 has been announced with proof-of-concept code. This vulnerability can only be exploited if WebDAV is enabled. IIS 6.0 is a component of Microsoft Windows Server 2003 (including R2.) Microsoft has ended support for Server 2003 on July 14, 2015, which means that this vulnerability will most likely not be patched. It is recommended that these systems be upgraded to a supported platform. The current workaround is to disable the WebDAV Web Service Extension if it is not needed by any web applications.
The Qualys Cloud Platform can help you detect the vulnerability, track and manage Server 2003 Assets, as well as block exploits against web-based vulnerabilities like this one.
### Detecting the Vulnerability
Qualys has re
Qualys
Protect Against Critical IIS 6.0 Buffer Overflow vulnerability (CVE-2017-7269) with Qualys WAF
blogs_qualys·2017-03-30·CVSS 9.8
CVE-2017-7269 [CRITICAL] Protect Against Critical IIS 6.0 Buffer Overflow vulnerability (CVE-2017-7269) with Qualys WAF
Security researchers have disclosed a Buffer Overflow vulnerability ( CVE-2017-7269 ) in the Microsoft Internet Information Service (IIS) 6.0 web server included in the Windows Server 2003 R2. Qualys Web Application Firewall (WAF) can help you block HTTP requests trying to exploit this vulnerability.
## About CVE-2017-7269
This vulnerability can be exploited using a PROPFIND HTTP request with a long string value in the IF header, starting with “<http://”. The vulnerability can allow attackers to mount Remote Code Execution attacks or cause Denial of Service in the vulnerable applications. Microsoft ended support for Windows Server 2003 R2 on July 14, 2015 and is not expected to provide a patch for this vulnerability.
PROPFIND is an HTTP method supported by the Web Distributed Authoring
Qualys
Protect Against Critical IIS 6.0 Buffer Overflow vulnerability (CVE-2017-7269) with Qualys WAF | Qualys
blogs_qualys·2017-03-30·CVSS 9.8
CVE-2017-7269 [CRITICAL] Protect Against Critical IIS 6.0 Buffer Overflow vulnerability (CVE-2017-7269) with Qualys WAF | Qualys
Security researchers have disclosed a Buffer Overflow vulnerability (CVE-2017-7269) in the Microsoft Internet Information Service (IIS) 6.0 web server included in the Windows Server 2003 R2. Qualys Web Application Firewall (WAF) can help you block HTTP requests trying to exploit this vulnerability.
### About CVE-2017-7269
This vulnerability can be exploited using a PROPFIND HTTP request with a long string value in the IF header, starting with “<http://”. The vulnerability can allow attackers to mount Remote Code Execution attacks or cause Denial of Service in the vulnerable applications. Microsoft ended support for Windows Server 2003 R2 on July 14, 2015 and is not expected to provide a patch for this vulnerability.
PROPFIND is an HTTP method supported by the Web Distributed Authoring a
Trendmicro
IIS 6.0 Vulnerability Leads to Code Execution
blogs_trendmicro·2017-03-29·CVSS 9.8
CVE-2017-7269 [CRITICAL] IIS 6.0 Vulnerability Leads to Code Execution
Exploits & Vulnerabilities
## IIS 6.0 Vulnerability Leads to Code Execution
Microsoft Internet Information Services (IIS) 6.0 is vulnerable to a zero-day Buffer Overflow vulnerability (CVE-2017-7269) due to an improper validation of an ‘IF’ header in a PROPFIND request.
By: Trend Micro 2017/03/29 Read time: ( words)
Save to Folio
Microsoft Internet Information Services (IIS) 6.0 is vulnerable to a zero-day Buffer Overflow vulnerability ( CVE-2017-7269 ) due to an improper validation of an ‘IF’ header in a PROPFIND request
A remote attacker could exploit this vulnerability in the IIS WebDAV Component with a crafted request using PROPFIND method. Successful exploitation could result in denial of service condition or arbitrary code execution in the context of the user running the applic
Trendmicro
IIS 6.0 Vulnerability Leads to Code Execution
blogs_trendmicro·2017-03-29·CVSS 9.8
CVE-2017-7269 [CRITICAL] IIS 6.0 Vulnerability Leads to Code Execution
Exploits y vulnerabilidades
## IIS 6.0 Vulnerability Leads to Code Execution
Microsoft Internet Information Services (IIS) 6.0 is vulnerable to a zero-day Buffer Overflow vulnerability (CVE-2017-7269) due to an improper validation of an ‘IF’ header in a PROPFIND request.
By: Trend Micro Mar 29, 2017 Read time: ( words)
Save to Folio
Microsoft Internet Information Services (IIS) 6.0 is vulnerable to a zero-day Buffer Overflow vulnerability ( CVE-2017-7269 ) due to an improper validation of an ‘IF’ header in a PROPFIND request
A remote attacker could exploit this vulnerability in the IIS WebDAV Component with a crafted request using PROPFIND method. Successful exploitation could result in denial of service condition or arbitrary code execution in the context of the user running the app
Trendmicro
IIS 6.0 Vulnerability Leads to Code Execution
blogs_trendmicro·2017-03-29·CVSS 9.8
CVE-2017-7269 [CRITICAL] IIS 6.0 Vulnerability Leads to Code Execution
Exploits & Vulnerabilities
## IIS 6.0 Vulnerability Leads to Code Execution
Microsoft Internet Information Services (IIS) 6.0 is vulnerable to a zero-day Buffer Overflow vulnerability (CVE-2017-7269) due to an improper validation of an ‘IF’ header in a PROPFIND request.
By: Trend Micro Mar 29, 2017 Read time: ( words)
Save to Folio
Microsoft Internet Information Services (IIS) 6.0 is vulnerable to a zero-day Buffer Overflow vulnerability ( CVE-2017-7269 ) due to an improper validation of an ‘IF’ header in a PROPFIND request
A remote attacker could exploit this vulnerability in the IIS WebDAV Component with a crafted request using PROPFIND method. Successful exploitation could result in denial of service condition or arbitrary code execution in the context of the user running the appl
Trendmicro
IIS 6.0 Vulnerability Leads to Code Execution
blogs_trendmicro·2017-03-29·CVSS 9.8
CVE-2017-7269 [CRITICAL] IIS 6.0 Vulnerability Leads to Code Execution
Exploits & Vulnerabilities
# IIS 6.0 Vulnerability Leads to Code Execution
Microsoft Internet Information Services (IIS) 6.0 is vulnerable to a zero-day Buffer Overflow vulnerability (CVE-2017-7269) due to an improper validation of an ‘IF’ header in a PROPFIND request.
By: Trend Micro
2017/03/29
Read time: ( words)
Save to Folio
Microsoft Internet Information Services (IIS) 6.0 is vulnerable to a zero-day Buffer Overflow vulnerability (CVE-2017-7269) due to an improper validation of an ‘IF’ header in a PROPFIND request
A remote attacker could exploit this vulnerability in the IIS WebDAV Component with a crafted request using PROPFIND method. Successful exploitation could result in denial of service condition or arbitrary code execution in the context of the user running the applicat
Trendmicro
IIS 6.0 Vulnerability Leads to Code Execution
blogs_trendmicro·2017-03-29·CVSS 9.8
CVE-2017-7269 [CRITICAL] IIS 6.0 Vulnerability Leads to Code Execution
Sfruttamento vulnerabilità
## IIS 6.0 Vulnerability Leads to Code Execution
Microsoft Internet Information Services (IIS) 6.0 is vulnerable to a zero-day Buffer Overflow vulnerability (CVE-2017-7269) due to an improper validation of an ‘IF’ header in a PROPFIND request.
By: Trend Micro Mar 29, 2017 Read time: ( words)
Save to Folio
Microsoft Internet Information Services (IIS) 6.0 is vulnerable to a zero-day Buffer Overflow vulnerability ( CVE-2017-7269 ) due to an improper validation of an ‘IF’ header in a PROPFIND request
A remote attacker could exploit this vulnerability in the IIS WebDAV Component with a crafted request using PROPFIND method. Successful exploitation could result in denial of service condition or arbitrary code execution in the context of the user running the appl
Trendmicro
IIS 6.0 Vulnerability Leads to Code Execution
blogs_trendmicro·2017-03-29·CVSS 9.8
CVE-2017-7269 [CRITICAL] IIS 6.0 Vulnerability Leads to Code Execution
Ausnutzung von Schwachstellen
## IIS 6.0 Vulnerability Leads to Code Execution
Microsoft Internet Information Services (IIS) 6.0 is vulnerable to a zero-day Buffer Overflow vulnerability (CVE-2017-7269) due to an improper validation of an ‘IF’ header in a PROPFIND request.
By: Trend Micro Mar 29, 2017 Read time: ( words)
Save to Folio
Microsoft Internet Information Services (IIS) 6.0 is vulnerable to a zero-day Buffer Overflow vulnerability ( CVE-2017-7269 ) due to an improper validation of an ‘IF’ header in a PROPFIND request
A remote attacker could exploit this vulnerability in the IIS WebDAV Component with a crafted request using PROPFIND method. Successful exploitation could result in denial of service condition or arbitrary code execution in the context of the user running the a
Threat Intel
BlackTech (BlackTech, Palmerworm)
threat_intel·CVSS 9.8
[CRITICAL] BlackTech (BlackTech, Palmerworm)
# Threat Actor Profile: BlackTech
ATT&CK ID: G0098
Also known as: BlackTech, Palmerworm
Suspected origin: China
## Overview
BlackTech is a suspected Chinese cyber espionage group that has primarily targeted organizations in East Asia--particularly Taiwan, Japan, and Hong Kong--and the US since at least 2013. BlackTech has used a combination of custom malware, dual-use tools, and living off the land tactics to compromise media, construction, engineering, electronics, and financial company networks.(Citation: TrendMicro BlackTech June 2017)(Citation: Symantec Palmerworm Sep 2020)(Citation: Reuters Taiwan BlackTech August 2020)
## Techniques (TTPs)
### Resource Development
- T1588.003 Code Signing Certificates
Usage: BlackTech has used stolen code-signing certificates for its malicious pay
arXiv
VulRG: Multi-Level Explainable Vulnerability Patch Ranking for Complex Systems Using Graphs
arxiv_fulltext·2025-02-16
VulRG: Multi-Level Explainable Vulnerability Patch Ranking for Complex Systems Using Graphs
VulRG: Multi-Level Explainable Vulnerability Patch Ranking for Complex Systems Using Graphs
Yuning Jiang
[email protected]
0000-0003-4791-8452
National University of Singapore
Singapore
Nay Oo
[email protected]
NCS Cyber Special Ops R&D
Singapore
Qiaoran Meng
[email protected]
National University of Singapore
Singapore
Hoon Wei Lim
[email protected]
NCS Cyber Special Ops R&D
Singapore
Biplab Sikdar
[email protected]
National University of Singapore
Singapore
Jiang et al.
## Abstract
As interconnected systems proliferate, safeguarding complex infrastructures against an escalating array of cyber threats has become an urgent challenge. The growing number of vulnerabilities, coupled with resource constraints, makes addressing every vulnerability impractical, thereby rende
arXiv
Dynamic Vulnerability Criticality Calculator for Industrial Control Systems
arxiv_fulltext·2024-03-20
Dynamic Vulnerability Criticality Calculator for Industrial Control Systems
Dynamic Vulnerability Criticality Calculator for Industrial Control Systems
Pavlos Cheimonidis addr1,e1
Kontantinos Rantos addr1,e2
e1e-mail: [email protected]
e2e-mail: [email protected]
Department of Computer Science, International Hellenic University, 654 04 Kavala, Greece
Received: date / Accepted: date
## Abstract
The convergence of information and communication technologies has introduced new and advanced capabilities to Industrial Control Systems. However, concurrently, it has heightened their vulnerability to cyber attacks. Consequently, the imperative for new security methods has emerged as a critical need for these organizations to effectively identify and mitigate potential threats. This paper introduces an innovative approach by proposing a dynamic vulnerability critical
arXiv
ATTACK2VEC: Leveraging Temporal Word Embeddings to Understand the Evolution of Cyberattacks
arxiv_fulltext·2019-05-29
ATTACK2VEC: Leveraging Temporal Word Embeddings to Understand the Evolution of Cyberattacks
: Leveraging Temporal Word Embeddings to
Understand the Evolution of Cyberattacks
## Abstract
Despite the fact that cyberattacks are constantly growing in complexity, the research community still lacks effective tools to easily monitor and understand them.
In particular, there is a need for techniques that are able to not only track how prominently certain malicious actions, such as the exploitation of specific vulnerabilities, are exploited in the wild, but also (and more importantly) how these malicious actions factor in as attack steps in more complex cyberattacks.
In this paper we present , a system that uses temporal word embeddings to model how attack steps are exploited in the wild, and track how they evolve.
We test on a dataset of billions of security events collected from the c
CTF
easy / README
ctf_writeups·CVSS 6.0
[MEDIUM] easy / README
---
layout: default
title: Easy Machines
parent: Machines
nav_order: 1
description: "120+ Easy HTB machine writeups with walkthroughs"
permalink: /machines/easy/
---
# HackTheBox Easy Machines - Comprehensive Reference
> Complete catalog of retired HTB Easy machines with OS, key vulnerability, attack path summary, and quality writeup links.
**Total: 100+ Easy Machines** | Updated: April 2026
---
## Quick Navigation
- [Classic / Legacy Machines (2017-2019)](#classic--legacy-machines-2017-2019)
- [2019-2020 Machines](#2019-2020-machines)
- [2021 Machines](#2021-machines)
- [2022 Machines](#2022-machines)
- [2023 Machines](#2023-machines)
- [2024 Machines (Season 4 & 5)](#2024-machines-season-4--5)
- [2025-2026 Machines (Season 6+)](#2025-2026-machines-season-6)
---
## Classic / Legac
http://www.securityfocus.com/bid/97127http://www.securitytracker.com/id/1038168https://0patch.blogspot.com/2017/03/0patching-immortal-cve-2017-7269.htmlhttps://github.com/danigargu/explodingcanhttps://github.com/edwardz246003/IIS_exploithttps://github.com/rapid7/metasploit-framework/pull/8162https://medium.com/%40iraklis/number-of-internet-facing-vulnerable-iis-6-0-to-cve-2017-7269-8bd153ef5812https://support.microsoft.com/en-us/help/3197835/description-of-the-security-update-for-windows-xp-and-windows-serverhttps://www.exploit-db.com/exploits/41738/https://www.exploit-db.com/exploits/41992/http://www.securityfocus.com/bid/97127http://www.securitytracker.com/id/1038168https://0patch.blogspot.com/2017/03/0patching-immortal-cve-2017-7269.htmlhttps://github.com/danigargu/explodingcanhttps://github.com/edwardz246003/IIS_exploithttps://github.com/rapid7/metasploit-framework/pull/8162https://medium.com/%40iraklis/number-of-internet-facing-vulnerable-iis-6-0-to-cve-2017-7269-8bd153ef5812https://support.microsoft.com/en-us/help/3197835/description-of-the-security-update-for-windows-xp-and-windows-serverhttps://www.exploit-db.com/exploits/41738/https://www.exploit-db.com/exploits/41992/https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-7269
2017-03-27
Published
2021-11-03
Added to CISA KEV
Exploited in the wild