Snort protection against IIS 6.0 WebDAV exploit
Summary: Microsoft published Security Advisory 971491 on May 18, 2009 for an IIS vulnerability that can allow unauthorized access to a normally protected area of a website, and an attack against IIS 6.0 with WebDAV enabled was published at milw0rm. Snort already covers the vulnerability through its http_inspect preprocessor, provided ascii yes or utf_8 yes is added to the configuration.
What you should know: The exploit was public on milw0rm, so anyone running IIS 6.0 with WebDAV enabled is exposed to an attack that reaches protected parts of a site - and detection depends on a preprocessor setting many configurations may not have enabled.
Read the original at Cisco Talos ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026