It was possible to disable the remote IIS server by making a variation of a specially formed PROPFIND request. An attacker, exploiting this vulnerability, would be able to render the web service useless. If the server is 'business critical', the impact could be high.

disable the WebDAV extensions, as well as the PROPFIND command See http://support.microsoft.com/support/kb/articles/Q241/5/20.AS

• http://www.microsoft.com/technet/security/bulletin/MS01-016.mspx

---

Updated on 2015-03-25