Description
Stack consumption vulnerability in the FTP Service in Microsoft Internet Information Services (IIS) 5.0 through 7.0 allows remote authenticated users to cause a denial of service (daemon crash) via a list (ls) -R command containing a wildcard that references a subdirectory, followed by a .. (dot dot), aka "IIS FTP Service DoS Vulnerability."
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Metasploit 1 module
-
Microsoft IIS FTP Server LIST Stack Exhaustion
auxiliary/dos/windows/ftp/iis_list_exhaustion
Exploit-DB 2
- Microsoft IIS 7.0 FTP Server - Stack Exhaustion Denial of Service (MS09-053) (Metasploit) EDB-17476 · dos · Jul 3, 2011
- Microsoft IIS 5.0/6.0 FTP Server - Stack Exhaustion Denial of Service EDB-9587 · dos · Sep 4, 2009 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- oval:org.mitre.oval:def:6508 vdb-entry signature
- 975191 vendor-advisory
- TA09-286A third-party-advisory
- MS09-053 vendor-advisory
- 20090903 Microsoft Internet Information Services 5.0/6.0 FTP SERVER DENIAL OF SERVICE ("Stack Exhaustion") mailing-list