TW-WebServer Denial Of Service Vulnerability

Bugtraq ID:	7368
Class:	Boundary Condition Error
CVE:
Remote:	Yes
Local:	No
Published:	Apr 16 2003 12:00AM
Updated:	Apr 16 2003 12:00AM
Credit:	Discovery of this vulnerability has been credited to "badpack3t" <[email protected]>.
Vulnerable:	Twilight Utilities TW_WebServer 1.0
Not Vulnerable:

TW-WebServer Denial Of Service Vulnerability

It has been reported that TW-WebServer is prone to a denial of service vulnerability. Reportedly when an excessive quantity of data is sent to the TW-Webserver as part of a malicious HTTP GET request the server will fail.

Although unconfirmed, due to the nature of this vulnerability, an attacker may have the ability to supply and execute arbitrary code.

TW-WebServer Denial Of Service Vulnerability

The following proof of concept was supplied:

• /data/vulnerabilities/exploits/sp-urfuqed.pl
• /data/vulnerabilities/exploits/ss-dos.c

TW-WebServer Denial Of Service Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

TW-WebServer Denial Of Service Vulnerability

References:

• Twilight Utilities TW-WebServer/1, 3, 2, 0 DoS ("badpack3t" )
  
• WebServer Homepage (Twilight Utilities)