Nylon Proxy Receive Function Denial Of Service Vulnerability

Bugtraq ID:	5938
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Oct 10 2002 12:00AM
Updated:	Oct 10 2002 12:00AM
Credit:	Vulnerability discovery credited to ZARAZA <[email protected]>.
Vulnerable:	nylon nylon 0.2
Not Vulnerable:	nylon nylon 1.0

Nylon Proxy Receive Function Denial Of Service Vulnerability

Nylon is a freely available, open source proxy software package. It is available for Unix and Linux operating systems.

Under some circumstances, it may be possible for a remote user to cause a denial of service. Nylon does not properly check the return value of the recv() call. While connected to a vulnerable proxy, if a client disconnects from the proxy during the time nylon is recv()'ing data, the function will not exit. This could lead to resource consumption, and denial of service.

Nylon Proxy Receive Function Denial Of Service Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Nylon Proxy Receive Function Denial Of Service Vulnerability

Solution:
This issue has been fixed in recent releases of nylon:


nylon nylon 0.2

• nylon nylon-1.0.tar.gz
  http://monkey.org/~marius/nylon/nylon-1.0.tar.gz

Nylon Proxy Receive Function Denial Of Service Vulnerability

References: