Monkey HTTP Daemon Invalid HTTP 'Connection' Header Denial Of Service Vulnerability

Bugtraq ID:	37307
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Dec 14 2009 12:00AM
Updated:	Dec 15 2009 09:03PM
Credit:	Patroklos Argyroudis
Vulnerable:	Monkey-Project Monkey Http Daemon 0.9.1 Monkey-Project Monkey Http Daemon 0.9 .0 + Gentoo Linux + Gentoo Linux Monkey-Project Monkey Http Daemon 0.8.2 Monkey-Project Monkey Http Daemon 0.8.1 Monkey-Project Monkey Http Daemon 0.8 Monkey-Project Monkey Http Daemon 0.7.2 Monkey-Project Monkey Http Daemon 0.7.1 Monkey-Project Monkey Http Daemon 0.7 .0 Monkey-Project Monkey Http Daemon 0.6.3 Monkey-Project Monkey Http Daemon 0.6.2 Monkey-Project Monkey Http Daemon 0.6.1 Monkey-Project Monkey Http Daemon 0.6 Monkey-Project Monkey Http Daemon 0.5.1 Monkey-Project Monkey Http Daemon 0.5 Monkey-Project Monkey Http Daemon 0.4.2 Monkey-Project Monkey Http Daemon 0.4.1 Monkey-Project Monkey Http Daemon 0.4 Monkey-Project Monkey Http Daemon 0.1.4 Monkey-Project Monkey Http Daemon 0.9.2
Not Vulnerable:	Monkey-Project Monkey Http Daemon 0.9.3

Monkey HTTP Daemon Invalid HTTP 'Connection' Header Denial Of Service Vulnerability

Monkey HTTP Daemon is prone to a denial-of-service vulnerability.

Remote attackers can exploit this issue to cause the application to crash, denying service to legitimate users.

Versions prior to Monkey HTTP Daemon 0.9.3 are vulnerable.

Monkey HTTP Daemon Invalid HTTP 'Connection' Header Denial Of Service Vulnerability

The following exploit code is available:

• /data/vulnerabilities/exploits/37037.py

Monkey HTTP Daemon Invalid HTTP 'Connection' Header Denial Of Service Vulnerability

Solution:
Updates are available. Please see the references for details.


Monkey-Project Monkey Http Daemon 0.9.2

• Monkey monkey-0.9.3.tar.gz
  http://www.monkey-project.com/versions/monkey-0.9.3.tar.gz

Monkey-Project Monkey Http Daemon 0.1.4

• Monkey monkey-0.9.3.tar.gz
  http://www.monkey-project.com/versions/monkey-0.9.3.tar.gz

Monkey-Project Monkey Http Daemon 0.4

• Monkey monkey-0.9.3.tar.gz
  http://www.monkey-project.com/versions/monkey-0.9.3.tar.gz

Monkey-Project Monkey Http Daemon 0.4.1

• Monkey monkey-0.9.3.tar.gz
  http://www.monkey-project.com/versions/monkey-0.9.3.tar.gz

Monkey-Project Monkey Http Daemon 0.4.2

• Monkey monkey-0.9.3.tar.gz
  http://www.monkey-project.com/versions/monkey-0.9.3.tar.gz

Monkey-Project Monkey Http Daemon 0.5

• Monkey monkey-0.9.3.tar.gz
  http://www.monkey-project.com/versions/monkey-0.9.3.tar.gz

Monkey-Project Monkey Http Daemon 0.5.1

• Monkey monkey-0.9.3.tar.gz
  http://www.monkey-project.com/versions/monkey-0.9.3.tar.gz

Monkey-Project Monkey Http Daemon 0.6

• Monkey monkey-0.9.3.tar.gz
  http://www.monkey-project.com/versions/monkey-0.9.3.tar.gz

Monkey-Project Monkey Http Daemon 0.6.1

• Monkey monkey-0.9.3.tar.gz
  http://www.monkey-project.com/versions/monkey-0.9.3.tar.gz

Monkey-Project Monkey Http Daemon 0.6.2

• Monkey monkey-0.9.3.tar.gz
  http://www.monkey-project.com/versions/monkey-0.9.3.tar.gz

Monkey-Project Monkey Http Daemon 0.6.3

• Monkey monkey-0.9.3.tar.gz
  http://www.monkey-project.com/versions/monkey-0.9.3.tar.gz

Monkey-Project Monkey Http Daemon 0.7 .0

• Monkey monkey-0.9.3.tar.gz
  http://www.monkey-project.com/versions/monkey-0.9.3.tar.gz

Monkey-Project Monkey Http Daemon 0.7.1

• Monkey monkey-0.9.3.tar.gz
  http://www.monkey-project.com/versions/monkey-0.9.3.tar.gz

Monkey-Project Monkey Http Daemon 0.7.2

• Monkey monkey-0.9.3.tar.gz
  http://www.monkey-project.com/versions/monkey-0.9.3.tar.gz

Monkey-Project Monkey Http Daemon 0.8

• Monkey monkey-0.9.3.tar.gz
  http://www.monkey-project.com/versions/monkey-0.9.3.tar.gz

Monkey-Project Monkey Http Daemon 0.8.1

• Monkey monkey-0.9.3.tar.gz
  http://www.monkey-project.com/versions/monkey-0.9.3.tar.gz

Monkey-Project Monkey Http Daemon 0.8.2

• Monkey monkey-0.9.3.tar.gz
  http://www.monkey-project.com/versions/monkey-0.9.3.tar.gz

Monkey-Project Monkey Http Daemon 0.9 .0

• Monkey monkey-0.9.3.tar.gz
  http://www.monkey-project.com/versions/monkey-0.9.3.tar.gz

Monkey-Project Monkey Http Daemon 0.9.1

• Monkey monkey-0.9.3.tar.gz
  http://www.monkey-project.com/versions/monkey-0.9.3.tar.gz

Monkey HTTP Daemon Invalid HTTP 'Connection' Header Denial Of Service Vulnerability

References:

• Monkey 0.9.3 (release name 'Ouch!') is out (Eduardo Silva)
  
• Monkey HTTP Daemon Product Page (Monkey)
  
• Monkey HTTPd improper input validation vulnerability (Patroklos Argyroudis)
  
• Monkey HTTPd improper input validation vulnerability (Patroklos Argyroudis )