Malformed WebDAV Request Can Cause IIS to Exhaust CPU Resources

A security vulnerability exists in the Micrsoft IIS 5.0 which could allow a remote attacker to cause a denial of service using a malformed WebDAV request and cause IIS to exhaust CPU resources.

Issue

WebDAV is an extension to the HTTP protocol that allows remote authoring and management of web content. In the Windows 2000 implementation of the protocol, IIS 5.0 performs initial processing of all WebDAV requests, then forwards the appropriate commands to the WebDAV process. However, a flaw exists in the way WebDAV handles a particular type of malformed request. If a stream of such requests were directed at an affected server, it would consume all CPU availability on the server.

Affected Products

• Microsoft IIS 5.0

Download

Patch: http://www.microsoft.com/Downloads/Release.asp?ReleaseID=28564

Further Details

Source: Microsoft Corporation

Reference: Microsoft Corporation

Updated: March 13, 2001

>> Recommended Download - secure your PC from spyware, adware and malware now with Spyware Doctor <<