NewAtlanta ServletExec/ISAPI JSPServlet Denial Of Service Vulnerability

Bugtraq ID:	4796
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2002-0894 CVE-2002-0894
Remote:	Yes
Local:	No
Published:	May 22 2002 12:00AM
Updated:	Mar 19 2015 08:51AM
Credit:	Discovery of this issue is credited to Matt Moore <[email protected]>.
Vulnerable:	NewAtlanta ServletExec/ISAPI 4.1 - Microsoft IIS 5.1 - Microsoft IIS 5.0 - Microsoft IIS 4.0
Not Vulnerable:

NewAtlanta ServletExec/ISAPI JSPServlet Denial Of Service Vulnerability

ServletExec/ISAPI is a plug-in Java Servlet/JSP engine for Microsoft IIS. It runs with IIS on Microsoft Windows NT/2000/XP systems.

A denial of service condition occurs when the JSPServlet is sent an overly long request either directly or via a request for a JSP file.

It has been reported that this will cause the underlying webserver to crash.

This condition may be the result of insufficient bounds checking, though this possibility has not been confirmed.

NewAtlanta ServletExec/ISAPI JSPServlet Denial Of Service Vulnerability

This issue may be exploited with a web browser.

• /data/vulnerabilities/exploits/servletexeccrash.c

NewAtlanta ServletExec/ISAPI JSPServlet Denial Of Service Vulnerability

Solution:
The vendor has released a fix which addresses this issue.


NewAtlanta ServletExec/ISAPI 4.1

• NewAtlanta ServletExec_4_1p9.zip
  ftp://ftp.newatlanta.com/public/4_1/patches/

NewAtlanta ServletExec/ISAPI JSPServlet Denial Of Service Vulnerability

References:

• NewAtlanta Homepage (NewAtlanta)