HTTP: IIS Malformed PROPFIND Remote DoS

This signature detects attempts to exploit a known vulnerability in Microsoft IIS 5.0. Attackers can send malicious "PROPFIND" requests to the server to crash it.

Extended Description

Microsoft Internet Information Services has been reported vulnerable to a denial of service. When WebDAV receives excessively long requests to the 'PROPFIND' or 'SEARCH' variables, the IIS service will fail. All current web, FTP, and email sessions will be terminated. IIS will automatically restart and normal service will resume. ** It has been reported that if a WebDAV request with a certain number of bytes is received, the Inetinfo service will remain alive but cease serving requests. This will cause the IIS server to stop serving requests until the service is manually restarted. This vulnerability was initially described in BID 7728 and is now being assigned its own BID.

Affected Products

Microsoft iis

References

BugTraq: 7735

CVE: CVE-2003-0226

URL: http://www.microsoft.com/technet/security/bulletin/MS03-018.mspx http://oval.mitre.org/oval/definitions/data/oval933.html

Short Name

HTTP:IIS:PROPFIND

Severity

Minor

Recommended

False

Recommended Action

None

HTTP: IIS Malformed PROPFIND Remote DoS

Extended Description

Affected Products

References

Found a potential security threat?