Apple QuickTime/Darwin Streaming Server view_broadcast.cgi Denial of Service Vulnerability

Bugtraq ID:	8257
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2003-0422
Remote:	Yes
Local:	No
Published:	Jul 23 2003 12:00AM
Updated:	Jul 11 2009 10:56PM
Credit:	Discovery is credited to Rapid7.
Vulnerable:	Apple Darwin Streaming Server 4.1.3 + Apple Mac OS X 10.3.2 + Apple Mac OS X 10.2.8 + Apple Mac OS X Server 10.3.2 + Apple Mac OS X Server 10.3.1 + Apple Mac OS X Server 10.3.1 + Apple Mac OS X Server 10.3 + Apple Mac OS X Server 10.3 + Apple Mac OS X Server 10.2.8 + Apple Mac OS X Server 10.2.8
Not Vulnerable:

Apple QuickTime/Darwin Streaming Server view_broadcast.cgi Denial of Service Vulnerability

Apple QuickTime/Darwin Streaming Server is prone to a denial of service condition. When an HTTP request is made to the view_broadcast.cgi script without specifying any parameters, the server will not accept new connections.

This vulnerability was reported to affect QuickTime/Darwin Streaming Server 4.1.3e and earlier on Windows.

Apple QuickTime/Darwin Streaming Server view_broadcast.cgi Denial of Service Vulnerability

This vulnerability can be exploited with a web browser.

Apple QuickTime/Darwin Streaming Server view_broadcast.cgi Denial of Service Vulnerability

Solution:
This vulnerability has reportedly been fixed in QuickTime/Darwin version 4.1.3f or later. Upgrades may be obtained from http://developer.apple.com/darwin/projects/streaming/

Apple QuickTime/Darwin Streaming Server view_broadcast.cgi Denial of Service Vulnerability

References:

• Darwin Streaming Server Homepage (Apple)