PT-2007-4197 · Microsoft · Internet Information Services

Kingcope · Published 2007-05-30 · Updated 2017-07-29 · CVE-2007-2897

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Microsoft Internet Information Services (IIS) version 6.0

Description The issue allows remote attackers to cause a denial of service, potentially obtain sensitive information, and possibly execute arbitrary code with physical access. This is achieved by sending requests for a URI containing a '/' immediately before and after the name of a DOS device, effectively bypassing the blacklist for DOS device requests.

Recommendations For Microsoft Internet Information Services (IIS) version 6.0, consider restricting access to the server to minimize the risk of exploitation, and apply configuration changes to prevent requests for URIs containing DOS device names. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2007-2897

Affected Products

Internet Information Services

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2007-2897 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/34418 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2897 · Note
• http://archives.neohapsis.com/archives/fulldisclosure/2007-05/0419.html · Note
• http://seclists.org/fulldisclosure/2007/May/0378.html · Note