Compaq Web-Based Management Agent Access Violation Denial of Service Vulnerability

Bugtraq ID:	8015
Class:	Failure to Handle Exceptional Conditions
CVE:
Remote:	Yes
Local:	No
Published:	Jun 23 2003 12:00AM
Updated:	Jun 23 2003 12:00AM
Credit:	This vulnerability was reported by Ian Vitek <[email protected]>.
Vulnerable:	Compaq Web-Based Management Agent
Not Vulnerable:

Compaq Web-Based Management Agent Access Violation Denial of Service Vulnerability

Compaq Web-Based Management Agent has been reported prone to a remote denial of service vulnerability when handling malformed GET requests. The resulting error reports an access violation, effectively causing the service to crash. A remote attacker could exploit this issue to deny agent services to legitimate users.

Compaq Web-Based Management Agent Access Violation Denial of Service Vulnerability

The following proof of concept example has been supplied:

GET /<!.FunctionContentType=(About 250 AAAAA:s)> HTTP/1.0

Compaq Web-Based Management Agent Access Violation Denial of Service Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Compaq Web-Based Management Agent Access Violation Denial of Service Vulnerability

References:

• Management Agents Homepage (HP)
  
• SSI vulnerability in Compaq Web Based Management Agent (Ian Vitek )