Description
Buffer overflow in ntdll.dll on Microsoft Windows NT 4.0, Windows NT 4.0 Terminal Server Edition, Windows 2000, and Windows XP allows remote attackers to execute arbitrary code, as demonstrated via a WebDAV request to IIS 5.0.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Metasploit 1 module
-
MS03-007 Microsoft IIS 5.0 WebDAV ntdll.dll Path Overflow
exploit/windows/iis/ms03_007_ntdll_webdav
Exploit-DB 9
- Microsoft IIS 5.0 - WebDAV 'ntdll.dll' Path Overflow (MS03-007) (Metasploit) EDB-16470 · remote · Jul 25, 2010 · verified
- Microsoft IIS 5.0 - WebDAV Remote Code Execution (3) (xwdav) EDB-51 · remote · Jul 8, 2003 · verified
- Microsoft Windows - WebDAV Remote Code Execution (2) EDB-36 · remote · Jun 1, 2003 · verified
- Microsoft IIS 5.0 (Windows XP/2000/NT 4.0) - WebDAV 'ntdll.dll' Remote Buffer Overflow (3) EDB-22367 · remote · Apr 4, 2003 · verified
- Microsoft IIS 5.0 (Windows XP/2000/NT 4.0) - WebDAV 'ntdll.dll' Remote Buffer Overflow (2) EDB-22366 · remote · Mar 31, 2003 · verified
- Microsoft IIS 5.0 - WebDAV Remote EDB-2 · remote · Mar 24, 2003 · verified
- Microsoft IIS 5.0 (Windows XP/2000/NT 4.0) - WebDAV 'ntdll.dll' Remote Buffer Overflow (1) EDB-22365 · remote · Mar 24, 2003 · verified
- Microsoft IIS - WebDAV 'ntdll.dll' Remote Overflow EDB-1 · remote · Mar 23, 2003 · verified
- Microsoft IIS 5.0 (Windows XP/2000/NT 4.0) - WebDAV 'ntdll.dll' Remote Buffer Overflow (4) EDB-22368 · remote · Mar 17, 2003 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- 20030326 WebDAV exploit: using wide character decoder scheme mailing-list
- 20030321 New attack vectors and a vulnerability dissection of MS03-007 mailing-list
- oval:org.mitre.oval:def:109 vdb-entry signature
- 20030325 IIS 5.0 WebDAV -Proof of concept-. Fully documented. mailing-list
- http://www.nextgenss.com/papers/ms03-007-ntdll.pdf
- http://www.iss.net/security_center/static/11533.php vdb-entry
- Q815021 vendor-advisory
- 20030317 Microsoft IIS WebDAV Remote Compromise Vulnerability third-party-advisory
- 20030328 Fate Research Labs Presents: Analysis of the NTDLL.DLL Exploit mailing-list
- 7116 vdb-entry
- http://microsoft.com/downloads/details.aspx?FamilyId=C9A38D45-5145-4844-B62E-C69D32AC929B&displaylang=en
- 20030708 WDAV exploit without netcat and with pretty magic number mailing-list
- 20030321 New attack vectors and a vulnerability dissection of MS03-007 mailing-list
- MS03-007 vendor-advisory
- VU#117394 third-party-advisory
- CA-2003-09 third-party-advisory