Sponsored By

Patch Unlikely for Widely Publicized Flaw in Microsoft IIS 6.0

Microsoft recommends upgrade to latest operating system for more protection.

Dark Reading Staff

March 30, 2017

1 Min Read

A zero-day vulnerability in Microsoft's IIS 6.0 Web server software remains unfixed even after two Chinese researchers recently posted a proof-of-concept exploit for it, Threatpost reports. Microsoft recommends "that customers upgrade to our latest operating systems and benefit from robust, modern protection."

The flaw is a buffer overflow in the ScStoragePathFromUrl function in the WebDAV service which allows an arbitrary code to be remotely executed in a PROPFIND request using a long header beginning with "If: <http://."  Microsoft says the current supported versions are not impacted. Disabling WebDAV helps mitigate attacks, Threatpost said.

IIS, or Internet Information Services, currently supports 11.4% of websites behind Apache and Nginx. Among all IIS versions, 11.3% run version 6, and many websites still run on unsupported versions of the software, the report said.

Read details here.

About the Author(s)

Dark Reading Staff

Dark Reading

Dark Reading is a leading cybersecurity media site.

Keep up with the latest cybersecurity threats, newly discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

You May Also Like


More Insights