Microsoft Windows Server Buffer Overflow Vulnerability (CVE-2017-7269)

What is affected, what to do

Buffer overflow in the ScStoragePathFromUrl function in the WebDAV service in Internet Information Services (IIS) 6.0 in Microsoft Windows Server 2003 R2 allows remote attackers to execute arbitrary code via a long header beginning with "If: <http://" in a PROPFIND request, as exploited in the wild in July or August 2016.

The vulnerability is being actively exploited; treat it as a priority. The available sources name no fixed version. Check the vendor guidance in the references below. Immediate actions, mitigation and detection rules are in the runbook below.

Affected

• Microsoft Internet Information Services (IIS) eq 6.0..6.0

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Response and mitigation

1. 01

   Runbook step 1

   Immediate response (0-24 h)

   • Find every instance: Identify all Windows Server 2003 / 2003 R2 hosts running IIS 6.0, using the CMDB, Nmap (http-webdav-scan, http-server-header matching Microsoft-IIS/6.0) or your external attack-surface scanner. Treat any internet-facing hit as compromised until proven otherwise.
   • Kill WebDAV now: In IIS Manager, open "Web Service Extensions", set "WebDAV" to "Prohibited" and run iisreset. This removes the vulnerable ScStoragePathFromUrl code path from reach.
   • Check for the vendor fix: Microsoft released an out-of-band security update for this end-of-support platform. Look up the KB number in the vendor advisory. Treat it as a stopgap only, because Windows Server 2003 receives no regular security updates.
   • Restrict exposure: Limit TCP 80/443 to these hosts at the perimeter firewall to known source ranges, or block it entirely. If neither is possible, pull the host off the network until WebDAV is disabled.
   • Start a compromise assessment: On internet-exposed IIS 6.0 systems, preserve IIS logs, the running process list and local accounts. Then rotate service-account and local admin credentials from a known-clean system. Rebuild compromised hosts rather than cleaning them.
2. 02

   Runbook step 2

   Mitigation layers

   • Network segmentation: Move any remaining Server 2003 systems into an isolated legacy VLAN. Default-deny their egress to the internet and to server and client networks to break reverse shells and lateral movement.
   • Reverse proxy/WAF: Restrict a fronting proxy or WAF to the HTTP methods GET, HEAD and POST, and drop PROPFIND, PROPPATCH, MKCOL, LOCK and UNLOCK. Also reject requests whose If: header exceeds roughly 256 bytes or begins with If: <http://.
   • IPS signature: Enable a Suricata/Snort rule pairing http.method; content:"PROPFIND" with http.header; content:"If|3a| <http|3a|//" plus a length check (isdataat). Commercial rulesets (ET/Talos) ship ready-made signatures. Run them in blocking mode.
   • Host hardening: Deploy URLScan on IIS 6.0. In urlscan.ini, set UseAllowVerbs=1 and list only GET, HEAD and POST under [AllowVerbs]. Cap header sizes via [RequestLimits].
   • Least privilege: Run the application pool as Network Service or a dedicated non-admin account. This keeps code execution confined to the w3wp.exe context.
   • Strategic: Record migration to a supported Windows Server/IIS release as a dated treatment action in the risk register. Running Server 2003 is very hard to defend as an "appropriate measure" under NIS2 or ISO 27001 (A.8.8).
3. 03

   Runbook step 3

   Detection rules

   • IIS logs (W3SVC, %SystemRoot%\system32\LogFiles\W3SVC*): Hunt for cs-method = PROPFIND, especially with status 500 or dropped connections. SPL: index=iis cs_method=PROPFIND | stats count by c_ip, cs_uri_stem, sc_status. The If header is not logged by default, so pair this with network visibility.
   • Network telemetry (Zeek/Suricata): Filter Zeek http.log for method == "PROPFIND" to IIS 6.0 targets. Inspect raw headers (http_header events) for If: <http://localhost/ followed by very long Unicode or letter strings. The public exploit uses this pattern with alphanumeric shellcode.
   • Process ancestry (Server 2003 Security log): Review Event ID 592 (process creation, the predecessor of 4688) for w3wp.exe or the WebDAV-hosting svchost.exe spawning cmd.exe, powershell.exe, cscript.exe, wscript.exe, net.exe or certutil.exe. Process-tracking audit must be enabled. Sysmon does not support Server 2003.
   • Crash indicators: Repeated unexpected w3wp.exe terminations in the System and Application logs (W3SVC worker-process failure warnings, application error events) point to failed exploit attempts. Correlate them with PROPFIND requests from the same source IP.
   • Egress anomalies: Alert on new outbound TCP sessions from the IIS host to unknown destinations, for example reverse shells on 4444 or 443, in firewall or NetFlow data. Sigma shape: src_host in legacy_iis AND direction=outbound AND dst_ip NOT IN allowlist.

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

Buffer overflow in the ScStoragePathFromUrl function in the WebDAV service in Internet Information Services (IIS) 6.0 in Microsoft Windows Server 2003 R2 allows remote attackers to execute arbitrary code via a long header beginning with "If: <http://" in a PROPFIND request, as exploited in the wild in July or August 2016.

Source: NVD (NIST), cvelistv5, CISA KEV Catalog, CVE.org (MITRE)

Vendors and products

• Microsoft Microsoft Internet Information Services (IIS)

Weakness classes (CWE)

• CWE-120Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

  Base

  The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer.

  Entry at MITRE CWE-120

References & sources

• exploit-db.com41992Exploit, x_refsource_EXPLOIT-DB, Exploit, Third-party advisory, Vulnerability database
• securityfocus.com97127Vulnerability database, x_refsource_BID, Broken link, Third-party advisory, Vulnerability database
• medium.com@iraklis/number-of-internet-facing-vulnerable-iis-6-0-to-cve-20…x_refsource_MISC, Exploit
• github.comrapid7/metasploit-framework/pull/8162x_refsource_MISC, Issue tracking, Patch
• github.comdanigargu/explodingcanx_refsource_MISC, Exploit
• securitytracker.com1038168Vulnerability database, x_refsource_SECTRACK, Broken link, Third-party advisory, Vulnerability database
• exploit-db.com41738Exploit, x_refsource_EXPLOIT-DB, Exploit, Third-party advisory, Vulnerability database
• support.microsoft.comen-us/help/3197835/description-of-the-security-update-for-windo…x_refsource_CONFIRM, Broken link, Patch, Vendor advisory
• 0patch.blogspot.com2017/03/0patching-immortal-cve-2017-7269.htmlx_refsource_MISC, Exploit, Third-party advisory
• github.comedwardz246003/IIS_exploitx_refsource_MISC, Broken link, Third-party advisory
• cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2017-7269government-resource, US government resource