PT-2007-1572 · Microsoft · Internet Information Services

Published 2007-01-05 · Updated 2025-09-22 · CVE-2007-0087

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Internet Information Services (IIS) (affected versions not specified)

Description The issue allows remote attackers to cause a denial of service, specifically network bandwidth consumption, by accessing the server through a TCP connection with a large window size and using a Range header that specifies multiple copies of the same fragment. The severity of this issue has been disputed by third parties, who argue that the required large window size is not typically supported or configured by the server, or that a similar effect could be achieved through a DDoS-style attack.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2007-0087

Affected Products

Internet Information Services

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2007-0087 · Security Note
• http://osvdb.org/33457 · Note
• http://securityfocus.com/archive/1/455920/100/0/threaded · Note
• http://securityfocus.com/archive/1/455879/100/0/threaded · Note
• http://securityfocus.com/archive/1/455833/100/0/threaded · Note
• https://t.me/cvenotify/89621 · Telegram Post
• http://securityfocus.com/archive/1/455882/100/0/threaded · Note