Northern Solutions Xeneo Web Server Denial Of Service Vulnerability

Bugtraq ID:	6098
Class:	Input Validation Error
CVE:	CVE-2002-1248
Remote:	Yes
Local:	No
Published:	Nov 04 2002 12:00AM
Updated:	Jul 11 2009 06:06PM
Credit:	Discovery of this vulnerability credited to Tamer Sahin.
Vulnerable:	Northern Solutions Xeneo Web Server 2.2.10 Northern Solutions Xeneo Web Server 2.2.9 .0 Northern Solutions Xeneo Web Server 2.1 .0.0
Not Vulnerable:	Northern Solutions Xeneo Web Server 2.1.6 .0 Northern Solutions Xeneo Web Server 2.1.5

Northern Solutions Xeneo Web Server Denial Of Service Vulnerability

A denial of service vulnerability has been reported for Xeneo web server. When the web server processes a malformed HTTP request, it will crash and lead to the denial of service condition.

Northern Solutions Xeneo Web Server Denial Of Service Vulnerability

The following proof of concept was provided:

http://www.example.com/%
http://www.example.com/%A

Northern Solutions Xeneo Web Server Denial Of Service Vulnerability

Solution:
Xeneo Web server 2.2.10 is not vulnerable to this issue:


Northern Solutions Xeneo Web Server 2.1 .0.0

• Northern Solutions Xeneo Web Server 2.2.10.0
  http://www.northernsolutions.com/index.php?view=product&sec=download&i d=1

Northern Solutions Xeneo Web Server 2.2.9 .0

• Northern Solutions Xeneo Web Server 2.2.10.0
  http://www.northernsolutions.com/index.php?view=product&sec=download&i d=1

Northern Solutions Xeneo Web Server Denial Of Service Vulnerability

References:

• Xeneo Web Server URL Encoding Denial of Service (Secunia Security Advisories )
  
• Xeneo? Web Server (Northern Solutions)