From: Secunia Security Advisories (sec-advsecunia.com)
Date: Thu Jul 10 2003 - 03:26:31 CDT

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

TITLE:
TinyWEB Denial of Service Vulnerability

READ ONLINE:
http://www.secunia.com/advisories/9226/

CRITICAL:
Less critical

IMPACT:
DoS

WHERE:
From remote

SOFTWARE:
TinyWEB 1.x

DESCRIPTION:
A vulnerability has been reported in TinyWEB, which can be exploited
by malicious people to cause a DoS (Denial of Service) on a
vulnerable web server.

The vulnerability is caused due to an exceptional handling error when
receiving certain HTTP requests, which can be exploited to consume
large amounts of CPU resources.

Example:
http://[victim]/cgi-bin/.%00./dddd.html

Successful exploitation requires that the "cgi-bin/" folder exists.

Secunia has confirmed the vulnerability in version 1.9. However,
other versions may also be affected.

SOLUTION:
Filter malicious requests in a HTTP proxy or firewall with URL
filtering capabilities.

REPORTED BY / CREDITS:
Ziv Kamir

----------------------------------------------------------------------

Secunia recommends that you verify all advisories you receive, by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

Contact details:
Web : http://www.secunia.com/
E-mail : supportsecunia.com
Tel : +44 (0) 20 7016 2693
Fax : +44 (0) 20 7637 0419

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories

----------------------------------------------------------------------

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]