Imatix Xitami Long Header Denial Of Service Vulnerability

Bugtraq ID:	8665
Class:	Failure to Handle Exceptional Conditions
CVE:
Remote:	Yes
Local:	No
Published:	Sep 22 2003 12:00AM
Updated:	Sep 22 2003 12:00AM
Credit:	Discovery is credited to Oliver Karow <[email protected]>.
Vulnerable:	Imatix Xitami 2.5 b4 Imatix Xitami 2.4 d9
Not Vulnerable:	Imatix Xitami 2.5 b6 Imatix Xitami 2.4 d10

Imatix Xitami Long Header Denial Of Service Vulnerability

Xitami is prone to a denial of service vulnerability. This condition is known to occur when a .shtm file is requested with an overly long HTTP header. In particular, a header that is greater than or equal to 5154 bytes followed by a colon (:) will trigger this condition.

The server crash may be the result of a boundary condition error, though this has not been confirmed. If this is the case, it may also be possible to exploit this issue to execute arbitrary code.

This vulnerability is reported to affect Xitami on Windows platforms. It is not currently known if releases for other platforms are similarly affected.

Imatix Xitami Long Header Denial Of Service Vulnerability

Though there is no exploit required for this issue, the following proof-of-concept was submitted:

• /data/vulnerabilities/exploits/xitami-shtm-dos.pl

Imatix Xitami Long Header Denial Of Service Vulnerability

Solution:
The vendor has released upgrades which address this issue.


Imatix Xitami 2.4 d9

• iMatix Xitami 2.4d10
  http://www.xitami.com/download.htm

Imatix Xitami 2.5 b4

• iMatix Xitami 2.5b6
  http://www.xitami.com/download.htm

Imatix Xitami Long Header Denial Of Service Vulnerability

References:

• Xitami Homepage (iMatix)
  
• Denial of service vulnerability in Xitami Open Source Web Server (Oliver Karow )
  
• Vendor information - Xitami Web Server ("Pieter Hintjens" )