Mod_Survey SYSBASE Disk Resource Consumption Denial of Service Vulnerability

BID:7498

Info

Mod_Survey SYSBASE Disk Resource Consumption Denial of Service Vulnerability

Bugtraq ID: 7498
Class: Design Error
CVE:
Remote: Yes
Local: No
Published: May 05 2003 12:00AM
Updated: May 05 2003 12:00AM
Credit: The discovery of this vulnerability has been credited to Jesse Adelman.
Vulnerable: mod_survey mod_survey 3.0.15 -pre6
mod_survey mod_survey 3.0.15 -pre5
mod_survey mod_survey 3.0.15 -pre4
mod_survey mod_survey 3.0.15 -pre3
mod_survey mod_survey 3.0.15 -pre2
mod_survey mod_survey 3.0.15 -pre1
mod_survey mod_survey 3.0.14 e
mod_survey mod_survey 3.0.14 d
mod_survey mod_survey 3.0.14
mod_survey mod_survey 3.0.13
mod_survey mod_survey 3.0.12
mod_survey mod_survey 3.0.11
mod_survey mod_survey 3.0.10
mod_survey mod_survey 3.0.9
mod_survey mod_survey 3.0.8
mod_survey mod_survey 3.0.7
mod_survey mod_survey 3.0.6
mod_survey mod_survey 3.0.5
mod_survey mod_survey 3.0.4
mod_survey mod_survey 3.0.3
mod_survey mod_survey 3.0.2
mod_survey mod_survey 3.0.1
mod_survey mod_survey 3.0
Not Vulnerable: mod_survey mod_survey 3.0.15

Discussion

Mod_Survey SYSBASE Disk Resource Consumption Denial of Service Vulnerability

A vulnerability has been discovered in the Mod_Survey Apache module. The problem occurs due to a design error when handling nonexistent survey names. Specifically, before verifying the existence of a remotely requested survey the SYSBASE variable is initialized, resulting in the creation of a directory. This could be exploited to consume the available inodes or hard drive space on a target systems hard disk.

Exploit / POC

Mod_Survey SYSBASE Disk Resource Consumption Denial of Service Vulnerability

No exploit is required however, reports indicate that an exploit program has been developed which is designed to ease the process of exploitation. It should be noted that the exploit has not been made publicly available.

Solution / Fix

Mod_Survey SYSBASE Disk Resource Consumption Denial of Service Vulnerability

Solution:
The vendor has released Mod_Survey 3.0.15-stable to address this issue. An updated 'Document.pm' file has also be released which can be used to replace the file in the 'Survey' subdirectory for Mod_Survey 3.0.14 through 3.0.14e. Users are advised to upgrade as soon as possible.


mod_survey mod_survey 3.0

mod_survey mod_survey 3.0.1

mod_survey mod_survey 3.0.10

mod_survey mod_survey 3.0.11

mod_survey mod_survey 3.0.12

mod_survey mod_survey 3.0.13

mod_survey mod_survey 3.0.14 e

mod_survey mod_survey 3.0.14 d

mod_survey mod_survey 3.0.14

mod_survey mod_survey 3.0.15 -pre2

mod_survey mod_survey 3.0.15 -pre5

mod_survey mod_survey 3.0.15 -pre3

mod_survey mod_survey 3.0.15 -pre4

mod_survey mod_survey 3.0.15 -pre6

mod_survey mod_survey 3.0.15 -pre1

mod_survey mod_survey 3.0.2

mod_survey mod_survey 3.0.3

mod_survey mod_survey 3.0.4

mod_survey mod_survey 3.0.5

mod_survey mod_survey 3.0.6

mod_survey mod_survey 3.0.7

mod_survey mod_survey 3.0.8

mod_survey mod_survey 3.0.9

References

Mod_Survey SYSBASE Disk Resource Consumption Denial of Service Vulnerability

References:

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report