Anti-Web HTTPD Script Engine File Opening Denial Of Service Vulnerability
BID:3782
Info
Anti-Web HTTPD Script Engine File Opening Denial Of Service Vulnerability
| Bugtraq ID: | 3782 |
| Class: | Design Error |
| CVE: | |
| Remote: | No |
| Local: | Yes |
| Published: | Jan 04 2002 12:00AM |
| Updated: | Jan 04 2002 12:00AM |
| Credit: | This vulnerability was announced in an AngryPacket Security Advisory on January 3, 2002. |
| Vulnerable: |
Hardcore Software Anti-Web HTTPD 2.2 |
| Not Vulnerable: |
Hardcore Software Anti-Web HTTPD 2.2.1 |
Discussion
Anti-Web HTTPD Script Engine File Opening Denial Of Service Vulnerability
Anti-Web HTTPD is a freely available, open source web server designed for use on the Linux platform. It is maintained by Doug Hoyte.
Under certain circumstances awhttpd reacts unpredictably.
When a script is executed that opens a file that does not exist, awhttpd still attempts to open the file. When awhttpd attempts to close the non-existing file following the completion of the script, it becomes unstable and crashes, resulting in a denial of service.
Anti-Web HTTPD is a freely available, open source web server designed for use on the Linux platform. It is maintained by Doug Hoyte.
Under certain circumstances awhttpd reacts unpredictably.
When a script is executed that opens a file that does not exist, awhttpd still attempts to open the file. When awhttpd attempts to close the non-existing file following the completion of the script, it becomes unstable and crashes, resulting in a denial of service.
Exploit / POC
Anti-Web HTTPD Script Engine File Opening Denial Of Service Vulnerability
This examples was provided by methodic <[email protected]> in an AngryPacket Security Advisory:
a sample awhttpd script looks like this:
# test.cgi
--AWHTTPD SCRIPT--
echo "this is a test"
F:test.html
This examples was provided by methodic <[email protected]> in an AngryPacket Security Advisory:
a sample awhttpd script looks like this:
# test.cgi
--AWHTTPD SCRIPT--
echo "this is a test"
F:test.html
Solution / Fix
Anti-Web HTTPD Script Engine File Opening Denial Of Service Vulnerability
Solution:
Fixed version now available:
Hardcore Software Anti-Web HTTPD 2.2
Solution:
Fixed version now available:
Hardcore Software Anti-Web HTTPD 2.2
-
Hardcore Software awhttpd-2.2.1.tgz
http://hardcoresoftware.cjb.net/awhttpd/awhttpd-2.2.1.tgz
References
Anti-Web HTTPD Script Engine File Opening Denial Of Service Vulnerability
References:
References:
- Anti-Web HTTPD (Hardcore Software)