Appweb CVE-2014-9708 Null Pointer Deference Denial of Service Vulnerability

Bugtraq ID:	73407
Class:	Design Error
CVE:	CVE-2014-9708
Remote:	Yes
Local:	No
Published:	Mar 28 2015 12:00AM
Updated:	Jan 12 2017 08:05AM
Credit:	Matthew Daley
Vulnerable:	Paloaltonetworks PAN-OS 6.1.1 0 Paloaltonetworks PAN-OS 6.1.0 0 Paloaltonetworks PAN-OS 6.0.7 0 Paloaltonetworks PAN-OS 7.1.5 Paloaltonetworks PAN-OS 7.1.4 Paloaltonetworks PAN-OS 7.1.3 Paloaltonetworks PAN-OS 7.1.2 Paloaltonetworks PAN-OS 7.1.1 Paloaltonetworks PAN-OS 7.1 Paloaltonetworks PAN-OS 7.0.10 Paloaltonetworks PAN-OS 7.0.5 Paloaltonetworks PAN-OS 7.0.4 Paloaltonetworks PAN-OS 7.0.1 Paloaltonetworks PAN-OS 7.0 Paloaltonetworks PAN-OS 6.1.14 Paloaltonetworks PAN-OS 6.1.12 Paloaltonetworks PAN-OS 6.1.11 Paloaltonetworks PAN-OS 6.1.10 Paloaltonetworks PAN-OS 6.1.9 Paloaltonetworks PAN-OS 6.1.4 Paloaltonetworks PAN-OS 6.1.3 Paloaltonetworks PAN-OS 6.0.14 Paloaltonetworks PAN-OS 6.0.13 Paloaltonetworks PAN-OS 6.0.12 Paloaltonetworks PAN-OS 6.0.9 Paloaltonetworks PAN-OS 6.0.6 Paloaltonetworks PAN-OS 6.0.5 Paloaltonetworks PAN-OS 5.1.12 Paloaltonetworks PAN-OS 5.1.11 Paloaltonetworks PAN-OS 5.1.10 Paloaltonetworks PAN-OS 5.1.9 Paloaltonetworks PAN-OS 5.1.3 Paloaltonetworks PAN-OS 5.1.2 Paloaltonetworks PAN-OS 5.1.1 Paloaltonetworks PAN-OS 5.1 Paloaltonetworks PAN-OS 5.0.19 Paloaltonetworks PAN-OS 5.0.18 Paloaltonetworks PAN-OS 5.0.17 Paloaltonetworks PAN-OS 5.0.15 Paloaltonetworks PAN-OS 5.0.14 Paloaltonetworks PAN-OS 5.0.10 Paloaltonetworks PAN-OS 5.0.9 Paloaltonetworks PAN-OS 5.0.8 Paloaltonetworks PAN-OS 5.0.7 Paloaltonetworks PAN-OS 5.0.6 Paloaltonetworks PAN-OS 5.0.5 Paloaltonetworks PAN-OS 5.0.4 Paloaltonetworks PAN-OS 5.0.3 Paloaltonetworks PAN-OS 7.0.9 Paloaltonetworks PAN-OS 7.0.8 Paloaltonetworks PAN-OS 7.0.7 Paloaltonetworks PAN-OS 6.1.2 Paloaltonetworks PAN-OS 6.1.13 Paloaltonetworks PAN-OS 6.0 Paloaltonetworks PAN-OS 5.1.5 Paloaltonetworks PAN-OS 5.1.4 Paloaltonetworks PAN-OS 5.0.2 Paloaltonetworks PAN-OS 5.0.16 Paloaltonetworks PAN-OS 5.0.1 Paloaltonetworks PAN-OS 5.0 Oracle Enterprise Communications Broker 0 Embedthis Software Appweb 5.2 Embedthis Software Appweb 5.1 Embedthis Software Appweb 4.6.5 Embedthis Software Appweb 4.6.4 Embedthis Software Appweb 4.6.3 Embedthis Software Appweb 4.6.2 Embedthis Software Appweb 4.6.1 Embedthis Software Appweb 4.6 Embedthis Software Appweb 4.5 Embedthis Software Appweb 4.4 Embedthis Software Appweb 4.3 Embedthis Software Appweb 4.2 Embedthis Software Appweb 4.1 Embedthis Software Appweb 5.0 Embedthis Software Appweb 4.0
Not Vulnerable:	Paloaltonetworks PAN-OS 7.0.11 Paloaltonetworks PAN-OS 6.1.15 Paloaltonetworks PAN-OS 6.0.15 Paloaltonetworks PAN-OS 5.1.13 Paloaltonetworks PAN-OS 5.0.20 Paloaltonetworks PAN-OS 7.1.6 Oracle Enterprise Communications Broker PCz 2.0.0m4p1 Embedthis Software Appweb 5.2.1 Embedthis Software Appweb 4.6.6

Appweb CVE-2014-9708 Null Pointer Deference Denial of Service Vulnerability

Appweb is prone to a denial-of-service vulnerability due to a null-pointer deference condition.

An attacker can exploit this issue to cause a denial-of-service condition.

Appweb CVE-2014-9708 Null Pointer Deference Denial of Service Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Appweb CVE-2014-9708 Null Pointer Deference Denial of Service Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Appweb CVE-2014-9708 Null Pointer Deference Denial of Service Vulnerability

References:

• Advisory: CVE-2014-9708: Appweb Web Server (Matthew Daley)
  
• Appweb Homepage (Embedthis Software)
  
• Bad HTTP Range Header #413 (embedthis)
  
• cpujul2016: Oracle Critical Patch Update Advisory - July 2016 (Oracle)
  
• Web interface denial of service (PAN-SA-2016-0027) (Palo Alto Networks)