NullLogic Null HTTPd Remote Denial Of Service Vulnerability
BID:8697
Info
NullLogic Null HTTPd Remote Denial Of Service Vulnerability
| Bugtraq ID: | 8697 |
| Class: | Failure to Handle Exceptional Conditions |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Sep 24 2003 12:00AM |
| Updated: | Sep 24 2003 12:00AM |
| Credit: | The disclosure of this issue has been credited to Luigi Auriemma <[email protected]>. |
| Vulnerable: |
NullLogic Null HTTPd 0.5.1 NullLogic Null HTTPd 0.5 |
| Not Vulnerable: | |
Discussion
NullLogic Null HTTPd Remote Denial Of Service Vulnerability
Null HTTPd has been reported prone to a remotely triggered denial of service vulnerability.
The issue has been reported to present itself in the HTTP POST handling routines within the Null HTTPd server. It has been reported that a remote attacker may make a malicious HTTP POST request, specifying a 'Content-Length' value in the HTTP header and then sending data that amounts to 1 byte less that the specified Content-Length. This will reportedly leave each connection on the server in an open state. An attacker can exploit this condition to trigger a denial of service of the affected server.
Null HTTPd has been reported prone to a remotely triggered denial of service vulnerability.
The issue has been reported to present itself in the HTTP POST handling routines within the Null HTTPd server. It has been reported that a remote attacker may make a malicious HTTP POST request, specifying a 'Content-Length' value in the HTTP header and then sending data that amounts to 1 byte less that the specified Content-Length. This will reportedly leave each connection on the server in an open state. An attacker can exploit this condition to trigger a denial of service of the affected server.
Exploit / POC
NullLogic Null HTTPd Remote Denial Of Service Vulnerability
The following proof of concept has been supplied:
POST / HTTP/1.0
Content-Length: 10
123456789
A proof of concept exploit has been reported to be available at the following location. The integrity of this file however has not been verified by Symantec:
http://aluigi.altervista.org/poc/webpostmem.zip
The following proof of concept has been supplied:
POST / HTTP/1.0
Content-Length: 10
123456789
A proof of concept exploit has been reported to be available at the following location. The integrity of this file however has not been verified by Symantec:
http://aluigi.altervista.org/poc/webpostmem.zip
Solution / Fix
NullLogic Null HTTPd Remote Denial Of Service Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
NullLogic Null HTTPd Remote Denial Of Service Vulnerability
References:
References:
- Null HTTPd Project Page (NullLogic)
- NULLhttpd <= 0.5.1 remote resources consumption (Luigi Auriemma