Saint ExplodingCan, Who Burst the WebDAV

Patron of old and forgotten servers, IIS 6 WebDAV, and systems nobody dares switch off.

Life

CVE-2017-7269, published on 27 March 2017 together with a proof-of-concept exploit, is an overflow in the WebDAV service of Internet Information Services 6.0 on Windows Server 2003: a request with a long header beginning "If: <http://" is enough for remote code execution. Exploited in the wild as early as 2016, it became famous when it resurfaced in April under the name ExplodingCan among the tools stolen from the NSA; in June 2017 Microsoft made an exception and released a patch for the already unsupported system. Years later it was still reported on exposed servers.

Prayer

O Saint ExplodingCan, who bursts the servers no one updates any more, give us the courage to switch off what can no longer be healed. Amen.

How to celebrate

Celebrated by installing the June 2017 update KB3197835, disabling WebDAV on IIS 6 and, above all, migrating off out-of-support systems.

An out-of-support server is a gate left wide to the yard.