Yaws Multiple Header Request Denial of Service Vulnerability

Bugtraq ID:	33834
Class:	Design Error
CVE:	CVE-2009-0751
Remote:	Yes
Local:	No
Published:	Feb 19 2009 12:00AM
Updated:	Mar 16 2009 03:56PM
Credit:	Manuel Duran Aguete
Vulnerable:	Yaws Yaws 1.55 Yaws Yaws 1.54 Yaws Yaws 1.52 Yaws Yaws 1.51 Yaws Yaws 1.50 Yaws Yaws 1.79 Debian Linux 5.0 sparc Debian Linux 5.0 s/390 Debian Linux 5.0 powerpc Debian Linux 5.0 mipsel Debian Linux 5.0 mips Debian Linux 5.0 m68k Debian Linux 5.0 ia-64 Debian Linux 5.0 ia-32 Debian Linux 5.0 hppa Debian Linux 5.0 armel Debian Linux 5.0 arm Debian Linux 5.0 amd64 Debian Linux 5.0 alpha Debian Linux 5.0 Debian Linux 4.0 sparc Debian Linux 4.0 s/390 Debian Linux 4.0 powerpc Debian Linux 4.0 mipsel Debian Linux 4.0 mips Debian Linux 4.0 m68k Debian Linux 4.0 ia-64 Debian Linux 4.0 ia-32 Debian Linux 4.0 hppa Debian Linux 4.0 armel Debian Linux 4.0 arm Debian Linux 4.0 amd64 Debian Linux 4.0 alpha Debian Linux 4.0
Not Vulnerable:	Yaws Yaws 1.80

Yaws Multiple Header Request Denial of Service Vulnerability

Yaws is prone to a remote denial-of-service vulnerability because it fails to handle infinite header requests.

Successfully exploiting this issue will allow attackers to cause the affected application to consume memory, eventually denying service to legitimate users.

Versions prior to Yaws 1.80 are vulnerable.

Yaws Multiple Header Request Denial of Service Vulnerability

Attackers can use readily available network utilities to exploit this issue.

The following exploit code is available:

• /data/vulnerabilities/exploits/33834.pl

Yaws Multiple Header Request Denial of Service Vulnerability

Solution:
Updates are available. Please see the references for more information.


Debian Linux 4.0 arm

• Debian yaws_1.65-4etch1_arm.deb
  http://security.debian.org/pool/updates/main/y/yaws/yaws_1.65-4etch1_a rm.deb

Debian Linux 5.0 ia-64

• Debian yaws-chat_1.77-3+lenny1_all.deb
  http://security.debian.org/pool/updates/main/y/yaws/yaws-chat_1.77-3+l enny1_all.deb


• Debian yaws-mail_1.77-3+lenny1_all.deb
  http://security.debian.org/pool/updates/main/y/yaws/yaws-mail_1.77-3+l enny1_all.deb


• Debian yaws-wiki_1.77-3+lenny1_all.deb
  http://security.debian.org/pool/updates/main/y/yaws/yaws-wiki_1.77-3+l enny1_all.deb


• Debian yaws-yapp_1.77-3+lenny1_all.deb
  http://security.debian.org/pool/updates/main/y/yaws/yaws-yapp_1.77-3+l enny1_all.deb


• Debian yaws_1.77-3+lenny1_ia64.deb
  http://security.debian.org/pool/updates/main/y/yaws/yaws_1.77-3+lenny1 _ia64.deb

Debian Linux 4.0 powerpc

• Debian yaws_1.65-4etch1_powerpc.deb
  http://security.debian.org/pool/updates/main/y/yaws/yaws_1.65-4etch1_p owerpc.deb

Debian Linux 5.0 alpha

• Debian yaws-chat_1.77-3+lenny1_all.deb
  http://security.debian.org/pool/updates/main/y/yaws/yaws-chat_1.77-3+l enny1_all.deb


• Debian yaws-mail_1.77-3+lenny1_all.deb
  http://security.debian.org/pool/updates/main/y/yaws/yaws-mail_1.77-3+l enny1_all.deb


• Debian yaws-wiki_1.77-3+lenny1_all.deb
  http://security.debian.org/pool/updates/main/y/yaws/yaws-wiki_1.77-3+l enny1_all.deb


• Debian yaws-yapp_1.77-3+lenny1_all.deb
  http://security.debian.org/pool/updates/main/y/yaws/yaws-yapp_1.77-3+l enny1_all.deb


• Debian yaws_1.77-3+lenny1_alpha.deb
  http://security.debian.org/pool/updates/main/y/yaws/yaws_1.77-3+lenny1 _alpha.deb

Debian Linux 5.0 ia-32

• Debian yaws-chat_1.77-3+lenny1_all.deb
  http://security.debian.org/pool/updates/main/y/yaws/yaws-chat_1.77-3+l enny1_all.deb


• Debian yaws-mail_1.77-3+lenny1_all.deb
  http://security.debian.org/pool/updates/main/y/yaws/yaws-mail_1.77-3+l enny1_all.deb


• Debian yaws-wiki_1.77-3+lenny1_all.deb
  http://security.debian.org/pool/updates/main/y/yaws/yaws-wiki_1.77-3+l enny1_all.deb


• Debian yaws-yapp_1.77-3+lenny1_all.deb
  http://security.debian.org/pool/updates/main/y/yaws/yaws-yapp_1.77-3+l enny1_all.deb


• Debian yaws_1.77-3+lenny1_i386.deb
  http://security.debian.org/pool/updates/main/y/yaws/yaws_1.77-3+lenny1 _i386.deb

Debian Linux 5.0 s/390

• Debian yaws-chat_1.77-3+lenny1_all.deb
  http://security.debian.org/pool/updates/main/y/yaws/yaws-chat_1.77-3+l enny1_all.deb


• Debian yaws-mail_1.77-3+lenny1_all.deb
  http://security.debian.org/pool/updates/main/y/yaws/yaws-mail_1.77-3+l enny1_all.deb


• Debian yaws-wiki_1.77-3+lenny1_all.deb
  http://security.debian.org/pool/updates/main/y/yaws/yaws-wiki_1.77-3+l enny1_all.deb


• Debian yaws-yapp_1.77-3+lenny1_all.deb
  http://security.debian.org/pool/updates/main/y/yaws/yaws-yapp_1.77-3+l enny1_all.deb


• Debian yaws_1.77-3+lenny1_s390.deb
  http://security.debian.org/pool/updates/main/y/yaws/yaws_1.77-3+lenny1 _s390.deb

Debian Linux 5.0 mipsel

• Debian yaws-chat_1.77-3+lenny1_all.deb
  http://security.debian.org/pool/updates/main/y/yaws/yaws-chat_1.77-3+l enny1_all.deb


• Debian yaws-mail_1.77-3+lenny1_all.deb
  http://security.debian.org/pool/updates/main/y/yaws/yaws-mail_1.77-3+l enny1_all.deb


• Debian yaws-wiki_1.77-3+lenny1_all.deb
  http://security.debian.org/pool/updates/main/y/yaws/yaws-wiki_1.77-3+l enny1_all.deb


• Debian yaws-yapp_1.77-3+lenny1_all.deb
  http://security.debian.org/pool/updates/main/y/yaws/yaws-yapp_1.77-3+l enny1_all.deb


• Debian yaws_1.77-3+lenny1_mipsel.deb
  http://security.debian.org/pool/updates/main/y/yaws/yaws_1.77-3+lenny1 _mipsel.deb

Debian Linux 4.0 amd64

• Debian yaws_1.65-4etch1_amd64.deb
  http://security.debian.org/pool/updates/main/y/yaws/yaws_1.65-4etch1_a md64.deb

Debian Linux 4.0 ia-32

• Debian yaws_1.65-4etch1_i386.deb
  http://security.debian.org/pool/updates/main/y/yaws/yaws_1.65-4etch1_i 386.deb

Debian Linux 5.0 hppa

• Debian yaws-chat_1.77-3+lenny1_all.deb
  http://security.debian.org/pool/updates/main/y/yaws/yaws-chat_1.77-3+l enny1_all.deb


• Debian yaws-mail_1.77-3+lenny1_all.deb
  http://security.debian.org/pool/updates/main/y/yaws/yaws-mail_1.77-3+l enny1_all.deb


• Debian yaws-wiki_1.77-3+lenny1_all.deb
  http://security.debian.org/pool/updates/main/y/yaws/yaws-wiki_1.77-3+l enny1_all.deb


• Debian yaws-yapp_1.77-3+lenny1_all.deb
  http://security.debian.org/pool/updates/main/y/yaws/yaws-yapp_1.77-3+l enny1_all.deb


• Debian yaws_1.77-3+lenny1_hppa.deb
  http://security.debian.org/pool/updates/main/y/yaws/yaws_1.77-3+lenny1 _hppa.deb

Debian Linux 4.0 sparc

• Debian yaws_1.65-4etch1_sparc.deb
  http://security.debian.org/pool/updates/main/y/yaws/yaws_1.65-4etch1_s parc.deb

Debian Linux 4.0 s/390

• Debian yaws_1.65-4etch1_s390.deb
  http://security.debian.org/pool/updates/main/y/yaws/yaws_1.65-4etch1_s 390.deb

Debian Linux 5.0 m68k

• Debian yaws-chat_1.77-3+lenny1_all.deb
  http://security.debian.org/pool/updates/main/y/yaws/yaws-chat_1.77-3+l enny1_all.deb


• Debian yaws-mail_1.77-3+lenny1_all.deb
  http://security.debian.org/pool/updates/main/y/yaws/yaws-mail_1.77-3+l enny1_all.deb


• Debian yaws-wiki_1.77-3+lenny1_all.deb
  http://security.debian.org/pool/updates/main/y/yaws/yaws-wiki_1.77-3+l enny1_all.deb


• Debian yaws-yapp_1.77-3+lenny1_all.deb
  http://security.debian.org/pool/updates/main/y/yaws/yaws-yapp_1.77-3+l enny1_all.deb

Debian Linux 5.0 arm

• Debian yaws-chat_1.77-3+lenny1_all.deb
  http://security.debian.org/pool/updates/main/y/yaws/yaws-chat_1.77-3+l enny1_all.deb


• Debian yaws-mail_1.77-3+lenny1_all.deb
  http://security.debian.org/pool/updates/main/y/yaws/yaws-mail_1.77-3+l enny1_all.deb


• Debian yaws-wiki_1.77-3+lenny1_all.deb
  http://security.debian.org/pool/updates/main/y/yaws/yaws-wiki_1.77-3+l enny1_all.deb


• Debian yaws-yapp_1.77-3+lenny1_all.deb
  http://security.debian.org/pool/updates/main/y/yaws/yaws-yapp_1.77-3+l enny1_all.deb


• Debian yaws_1.77-3+lenny1_arm.deb
  http://security.debian.org/pool/updates/main/y/yaws/yaws_1.77-3+lenny1 _arm.deb

Debian Linux 4.0 alpha

• Debian yaws_1.65-4etch1_alpha.deb
  http://security.debian.org/pool/updates/main/y/yaws/yaws_1.65-4etch1_a lpha.deb

Debian Linux 5.0 armel

• Debian yaws-chat_1.77-3+lenny1_all.deb
  http://security.debian.org/pool/updates/main/y/yaws/yaws-chat_1.77-3+l enny1_all.deb


• Debian yaws-mail_1.77-3+lenny1_all.deb
  http://security.debian.org/pool/updates/main/y/yaws/yaws-mail_1.77-3+l enny1_all.deb


• Debian yaws-wiki_1.77-3+lenny1_all.deb
  http://security.debian.org/pool/updates/main/y/yaws/yaws-wiki_1.77-3+l enny1_all.deb


• Debian yaws-yapp_1.77-3+lenny1_all.deb
  http://security.debian.org/pool/updates/main/y/yaws/yaws-yapp_1.77-3+l enny1_all.deb


• Debian yaws_1.77-3+lenny1_armel.deb
  http://security.debian.org/pool/updates/main/y/yaws/yaws_1.77-3+lenny1 _armel.deb

Debian Linux 5.0

• Debian yaws-chat_1.77-3+lenny1_all.deb
  http://security.debian.org/pool/updates/main/y/yaws/yaws-chat_1.77-3+l enny1_all.deb


• Debian yaws-mail_1.77-3+lenny1_all.deb
  http://security.debian.org/pool/updates/main/y/yaws/yaws-mail_1.77-3+l enny1_all.deb


• Debian yaws-wiki_1.77-3+lenny1_all.deb
  http://security.debian.org/pool/updates/main/y/yaws/yaws-wiki_1.77-3+l enny1_all.deb


• Debian yaws-yapp_1.77-3+lenny1_all.deb
  http://security.debian.org/pool/updates/main/y/yaws/yaws-yapp_1.77-3+l enny1_all.deb

Debian Linux 5.0 amd64

• Debian yaws-chat_1.77-3+lenny1_all.deb
  http://security.debian.org/pool/updates/main/y/yaws/yaws-chat_1.77-3+l enny1_all.deb


• Debian yaws-mail_1.77-3+lenny1_all.deb
  http://security.debian.org/pool/updates/main/y/yaws/yaws-mail_1.77-3+l enny1_all.deb


• Debian yaws-wiki_1.77-3+lenny1_all.deb
  http://security.debian.org/pool/updates/main/y/yaws/yaws-wiki_1.77-3+l enny1_all.deb


• Debian yaws-yapp_1.77-3+lenny1_all.deb
  http://security.debian.org/pool/updates/main/y/yaws/yaws-yapp_1.77-3+l enny1_all.deb


• Debian yaws_1.77-3+lenny1_amd64.deb
  http://security.debian.org/pool/updates/main/y/yaws/yaws_1.77-3+lenny1 _amd64.deb

Debian Linux 4.0 mipsel

• Debian yaws_1.65-4etch1_mipsel.deb
  http://security.debian.org/pool/updates/main/y/yaws/yaws_1.65-4etch1_m ipsel.deb

Debian Linux 5.0 mips

• Debian yaws-chat_1.77-3+lenny1_all.deb
  http://security.debian.org/pool/updates/main/y/yaws/yaws-chat_1.77-3+l enny1_all.deb


• Debian yaws-mail_1.77-3+lenny1_all.deb
  http://security.debian.org/pool/updates/main/y/yaws/yaws-mail_1.77-3+l enny1_all.deb


• Debian yaws-wiki_1.77-3+lenny1_all.deb
  http://security.debian.org/pool/updates/main/y/yaws/yaws-wiki_1.77-3+l enny1_all.deb


• Debian yaws-yapp_1.77-3+lenny1_all.deb
  http://security.debian.org/pool/updates/main/y/yaws/yaws-yapp_1.77-3+l enny1_all.deb


• Debian yaws_1.77-3+lenny1_mips.deb
  http://security.debian.org/pool/updates/main/y/yaws/yaws_1.77-3+lenny1 _mips.deb

Debian Linux 5.0 powerpc

• Debian yaws-chat_1.77-3+lenny1_all.deb
  http://security.debian.org/pool/updates/main/y/yaws/yaws-chat_1.77-3+l enny1_all.deb


• Debian yaws-mail_1.77-3+lenny1_all.deb
  http://security.debian.org/pool/updates/main/y/yaws/yaws-mail_1.77-3+l enny1_all.deb


• Debian yaws-wiki_1.77-3+lenny1_all.deb
  http://security.debian.org/pool/updates/main/y/yaws/yaws-wiki_1.77-3+l enny1_all.deb


• Debian yaws-yapp_1.77-3+lenny1_all.deb
  http://security.debian.org/pool/updates/main/y/yaws/yaws-yapp_1.77-3+l enny1_all.deb


• Debian yaws_1.77-3+lenny1_powerpc.deb
  http://security.debian.org/pool/updates/main/y/yaws/yaws_1.77-3+lenny1 _powerpc.deb

Debian Linux 4.0 ia-64

• Debian yaws_1.65-4etch1_ia64.deb
  http://security.debian.org/pool/updates/main/y/yaws/yaws_1.65-4etch1_i a64.deb

Debian Linux 4.0 mips

• Debian yaws_1.65-4etch1_mips.deb
  http://security.debian.org/pool/updates/main/y/yaws/yaws_1.65-4etch1_m ips.deb

Debian Linux 5.0 sparc

• Debian yaws-chat_1.77-3+lenny1_all.deb
  http://security.debian.org/pool/updates/main/y/yaws/yaws-chat_1.77-3+l enny1_all.deb


• Debian yaws-mail_1.77-3+lenny1_all.deb
  http://security.debian.org/pool/updates/main/y/yaws/yaws-mail_1.77-3+l enny1_all.deb


• Debian yaws-wiki_1.77-3+lenny1_all.deb
  http://security.debian.org/pool/updates/main/y/yaws/yaws-wiki_1.77-3+l enny1_all.deb


• Debian yaws-yapp_1.77-3+lenny1_all.deb
  http://security.debian.org/pool/updates/main/y/yaws/yaws-yapp_1.77-3+l enny1_all.deb


• Debian yaws_1.77-3+lenny1_sparc.deb
  http://security.debian.org/pool/updates/main/y/yaws/yaws_1.77-3+lenny1 _sparc.deb

Yaws Multiple Header Request Denial of Service Vulnerability

References:

• Yaws Homepage (Yaws)