Microsoft IIS WebDAV Denial of Service Vulnerability

Bugtraq ID:	2453
Class:	Unknown
CVE:
Remote:	Yes
Local:	No
Published:	Mar 08 2001 12:00AM
Updated:	Mar 08 2001 12:00AM
Credit:	Posted in a Microsoft Security Bulletin (MS01-016) on March 8, 2001.
Vulnerable:	Microsoft IIS 5.0 - Microsoft Windows 2000 Advanced Server SP2 - Microsoft Windows 2000 Advanced Server SP2 - Microsoft Windows 2000 Advanced Server SP1 - Microsoft Windows 2000 Advanced Server SP1 + Microsoft Windows 2000 Advanced Server + Microsoft Windows 2000 Advanced Server - Microsoft Windows 2000 Datacenter Server SP2 - Microsoft Windows 2000 Datacenter Server SP2 - Microsoft Windows 2000 Datacenter Server SP1 - Microsoft Windows 2000 Datacenter Server SP1 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional SP1 + Microsoft Windows 2000 Professional + Microsoft Windows 2000 Professional - Microsoft Windows 2000 Server SP2 - Microsoft Windows 2000 Server SP2 - Microsoft Windows 2000 Server SP1 - Microsoft Windows 2000 Server SP1 + Microsoft Windows 2000 Server + Microsoft Windows 2000 Server
Not Vulnerable:

Microsoft IIS WebDAV Denial of Service Vulnerability

Microsoft IIS is subject to a denial of service condition. WebDAV contains a flaw in the handling of certain malformed requests, submitting multiple malformed WebDAV requests could cause the server to stop responding. This vulnerability is also known to restart all IIS services.

Microsoft IIS WebDAV Denial of Service Vulnerability

The following exploit has been provided by Georgi Guninski <[email protected]>:

• /data/vulnerabilities/exploits/vv5.pl

Microsoft IIS WebDAV Denial of Service Vulnerability

References:

• How to Disable WebDAV for IIS 5.0 (Microsoft)
  
• Microsoft Security Bulletin (MS01-016) (Microsoft)
  
• Microsoft Security Bulletin MS02-026 (Microsoft)