Pinnacle ShowCenter Web Interface Skin Denial Of Service Vulnerability
BID:11232
Info
Pinnacle ShowCenter Web Interface Skin Denial Of Service Vulnerability
| Bugtraq ID: | 11232 |
| Class: | Failure to Handle Exceptional Conditions |
| CVE: |
CVE-2004-1699 |
| Remote: | Yes |
| Local: | No |
| Published: | Sep 21 2004 12:00AM |
| Updated: | Jul 12 2009 07:06AM |
| Credit: | Discovery of this vulnerability is credited to Marc Ruef <[email protected]>. |
| Vulnerable: |
Pinnacle Systems ShowCenter 1.51 |
| Not Vulnerable: | |
Discussion
Pinnacle ShowCenter Web Interface Skin Denial Of Service Vulnerability
The Pinnacle Systems ShowCenter web-based interface is reported prone to a remote denial of service vulnerability.
The issue exists due to a lack of sanity checks performed on the Skin parameter of a ShowCenter script.
It is reported that the affect of this attack will be persistent, any request for the ShowCenter web-based interface received subsequent to an attack will result in 'File or Folder not found' error message, as the interface fails to render.
A remote attacker may exploit this condition to persistently deny service to the ShowCenter web-based interface.
The Pinnacle Systems ShowCenter web-based interface is reported prone to a remote denial of service vulnerability.
The issue exists due to a lack of sanity checks performed on the Skin parameter of a ShowCenter script.
It is reported that the affect of this attack will be persistent, any request for the ShowCenter web-based interface received subsequent to an attack will result in 'File or Folder not found' error message, as the interface fails to render.
A remote attacker may exploit this condition to persistently deny service to the ShowCenter web-based interface.
Exploit / POC
Pinnacle ShowCenter Web Interface Skin Denial Of Service Vulnerability
The following example is available:
http://www.example.com:8000/ShowCenter/SettingsBase.php?Skin=ATK
The following example is available:
http://www.example.com:8000/ShowCenter/SettingsBase.php?Skin=ATK
Solution / Fix
Pinnacle ShowCenter Web Interface Skin Denial Of Service Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
Pinnacle ShowCenter Web Interface Skin Denial Of Service Vulnerability
References:
References:
- ShowCenter Homepage (Pinnacle Systems)
- Pinnacle ShowCenter Skin Denial of Service (Marc Ruef