Signature Detail

HTTP: IIS Malformed PROPFIND Remote DoS

This signature detects attempts to exploit a known vulnerability in Microsoft IIS 5.0. Attackers can send malicious "PROPFIND" requests to the server to crash it.

Extended Description

Microsoft Internet Information Services has been reported vulnerable to a denial of service. When WebDAV receives excessively long requests to the 'PROPFIND' or 'SEARCH' variables, the IIS service will fail. All current web, FTP, and email sessions will be terminated. IIS will automatically restart and normal service will resume. ** It has been reported that if a WebDAV request with a certain number of bytes is received, the Inetinfo service will remain alive but cease serving requests. This will cause the IIS server to stop serving requests until the service is manually restarted. This vulnerability was initially described in BID 7728 and is now being assigned its own BID.

Affected Products

• Microsoft iis 5.0
• Microsoft iis 5.1

References

• BugTraq: 7735
• CVE: CVE-2003-0226
• URL: http://www.microsoft.com/technet/security/bulletin/MS03-018.mspx
• URL: http://oval.mitre.org/oval/definitions/data/oval933.html