CVE-2007-2897: High severity Microsoft Internet Information Server vulnerability
Microsoft Internet Information Services (IIS) 6.0 allows remote attackers to cause a denial of service (server instability or device hang), and possibly obtain sensitive information (device communication traffic); and might allow attackers with physical access to execute arbitrary code after connecting a data stream to a device COM port; via requests for a URI containing a '/' immediately before and after the name of a DOS device, as demonstrated by the /AUX/.aspx URI, which bypasses a blacklist for DOS device requests.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2007-2897?
CVE-2007-2897 is considered a critical vulnerability due to the potential for remote denial of service and sensitive information exposure.
How do I fix CVE-2007-2897?
To mitigate CVE-2007-2897, ensure you apply the latest security updates for Microsoft Internet Information Services 6.0.
What are the potential impacts of CVE-2007-2897?
The impacts of CVE-2007-2897 include server instability, device hanging, and the possibility of arbitrary code execution with physical access.
Who is affected by CVE-2007-2897?
CVE-2007-2897 affects systems running Microsoft Internet Information Services 6.0.
Can CVE-2007-2897 lead to unauthorized access?
While CVE-2007-2897 primarily causes denial of service, it may allow for information disclosure or arbitrary code execution if physical access is gained.