MiniWeb HTTP POST Headers Remote Denial of Service Vulnerability

Bugtraq ID:	24375
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2007-3159
Remote:	Yes
Local:	No
Published:	Jun 07 2007 12:00AM
Updated:	May 07 2015 05:37PM
Credit:	gbr is credited with discovering this issue.
Vulnerable:	MiniWeb MiniWeb 0.8.19 MiniWeb MiniWeb 0.8.1
Not Vulnerable:

MiniWeb HTTP POST Headers Remote Denial of Service Vulnerability

MiniWeb Http Server is prone to a denial-of-service vulnerability because it fails to adequately bounds-check user-supplied data before copying it to an insufficiently sized buffer.

An attacker can exploit this issue to cause the affected application to crash, effectively denying service to legitimate users.

MiniWeb Http Server 0.8.1 and 0.8.19 are vulnerable to this issue; other versions may also be vulnerable.

MiniWeb HTTP POST Headers Remote Denial of Service Vulnerability

The following proof-of-concept exploit code is available.

• /data/vulnerabilities/exploits/MiniWeb-POST_DoS-rexp.pl

MiniWeb HTTP POST Headers Remote Denial of Service Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

MiniWeb HTTP POST Headers Remote Denial of Service Vulnerability

References:

• Vendor Homepage (MiniWeb)