Counter.exe Denial of Service Vulnerabilities
BID:267
Info
Counter.exe Denial of Service Vulnerabilities
| Bugtraq ID: | 267 |
| Class: | Input Validation Error |
| CVE: |
CVE-1999-1030 CVE-1999-1031 |
| Remote: | Yes |
| Local: | No |
| Published: | May 19 1999 12:00AM |
| Updated: | Jul 11 2009 12:16AM |
| Credit: | This vulnerability was published in BUGTRAQ by David Litchfield <[email protected]>. |
| Vulnerable: |
Behold! Software Web Page Counter 2.7 |
| Not Vulnerable: | |
Discussion
Counter.exe Denial of Service Vulnerabilities
A set of vulnerabilities in the counter.exe web hit counter program enables denial of service attacks.
A malicious user can create a malformed like ",1" entry in the counter.log file by requesting a URL of the form "http://www.example.com/scripts/counter.exe?%0A". Any further attempt for request will result in an Access Violation in counter.exe.
A similar vulnerability exists if a user requests a URL of the form "http://www.example.com/scripts/counter.exe?AAAAA" with over 2200 A's.
All further requests for counter.exe are queued and are not processed until the error messages are cleared at the console. System memory may be decremented each time a request for counter.exe is queued.
A set of vulnerabilities in the counter.exe web hit counter program enables denial of service attacks.
A malicious user can create a malformed like ",1" entry in the counter.log file by requesting a URL of the form "http://www.example.com/scripts/counter.exe?%0A". Any further attempt for request will result in an Access Violation in counter.exe.
A similar vulnerability exists if a user requests a URL of the form "http://www.example.com/scripts/counter.exe?AAAAA" with over 2200 A's.
All further requests for counter.exe are queued and are not processed until the error messages are cleared at the console. System memory may be decremented each time a request for counter.exe is queued.
Exploit / POC
Counter.exe Denial of Service Vulnerabilities
see discussion
see discussion
References
Counter.exe Denial of Service Vulnerabilities
References:
References: