Xitami Webserver empty GET request DoS Vulnerability

Bugtraq ID:	3511
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Mar 29 2000 12:00AM
Updated:	Mar 29 2000 12:00AM
Credit:	Discovered by Roman <[email protected]> and submitted to SecurityFocus on March 29, 2000.
Vulnerable:	Imatix Xitami for Windows 2.5 b4 - Microsoft Windows 98 - Microsoft Windows ME Imatix Xitami for Windows 2.4 d7 - Microsoft Windows 98 - Microsoft Windows ME Imatix Xitami for Windows 2.4 d2 - Microsoft Windows 3.1 - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows NT 4.0
Not Vulnerable:	Imatix Xitami for Windows 2.5 b5 Imatix Xitami for Windows 2.4 d9 - Compaq OpenVMS 7.3 VAX - Compaq OpenVMS 7.3 Alpha - IBM OS/2 Warp Server 4 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0

Xitami Webserver empty GET request DoS Vulnerability

Xitami is a webserver for Windows from Imatix.

Versions of Xitami are vulnerable to a denial of service attack.

It is possible to crash a server remotely by connecting with telnet on the web server port and submitting the following request:

GET<space><enter><enter>

Xitami Webserver empty GET request DoS Vulnerability

No exploit code is required to take advantage of this issue.