ProjectForum find Request Denial of Service Vulnerability

Bugtraq ID:	9271
Class:	Boundary Condition Error
CVE:
Remote:	Yes
Local:	No
Published:	Dec 22 2003 12:00AM
Updated:	Dec 22 2003 12:00AM
Credit:	The disclosure of this issue has been credited to Peter Winter-Smith <[email protected]>.
Vulnerable:	CourseForum Technologies ProjectForum 8.4.2 .1
Not Vulnerable:

ProjectForum find Request Denial of Service Vulnerability

It has been reported that ProjectForum may be prone to a denial of service vulnerability that may allow an attacker to cause the server to crash by sending an excessively long string via the 'find' request to the server.

ProjectForum versions 8.4.2.1 and prior have been reported to be prone to this issue.

ProjectForum find Request Denial of Service Vulnerability

The following proof of concept has been supplied:

• /data/vulnerabilities/exploits/pf_dos_poc.pl

ProjectForum find Request Denial of Service Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

ProjectForum find Request Denial of Service Vulnerability

References:

• ProjectForum Product Page (CourseForum Technologies)
  
• ProjectForum Multiple Vulnerabilities ("Peter Winter-Smith" )