Microsoft IIS WebDav ScStoragePathFromUrl Overflow
Posted by deepcore on May 11, 2017 – 10:14 am
Buffer overflow in the ScStoragePathFromUrl function in the WebDAV service in Internet Information Services (IIS) 6.0 in Microsoft Windows Server 2003 R2 allows remote attackers to execute arbitrary code via a long header beginning with “If: <http://" in a PROPFIND request, as exploited in the wild in July or August 2016. Original exploit by Zhiniang Peng and Chen Wu.
Post a reply
You must be logged in to post a comment.