Home    |    View Topics    |    Search    |    Contact Us    |   



Category:   Application (Web Server/CGI)  >   Reptile Web Server Vendors:   Fiack, Vincent
Reptile Web Server HTTP Request Flaw Lets Remote Users Deny Service
SecurityTracker Alert ID:  1008842
SecurityTracker URL:
CVE Reference:   GENERIC-MAP-NOMATCH   (Links to External Site)
Date:  Jan 25 2004
Impact:   Denial of service via network
Exploit Included:  Yes  
Version(s): "daily version" (dated January 4, 2002)
Description:   A vulnerability was reported in the Reptile Web Server. A remote user can cause denial of service conditions on the target system.

Donato Ferrante reported that a remote user can send a series of HTTP GET requests that do not contain the HTTP version string to cause the target web service to consume excessive CPU resources.

It is reported that a remote user can send the following request (assuming that the requested file is a file that exists on the target server) approximately 10 times to cause denial of service conditions on the server:

GET index.htm

Impact:   A remote user can cause excessive CPU resource consumption on the target system.
Solution:   No solution was available at the time of this entry.

The report indicates that the project is no longer supported.

Vendor URL: (Links to External Site)
Cause:   State error
Underlying OS:  Linux (Any), UNIX (Any)

Message History:   None.

 Source Message Contents

Subject:  Resources consumption in Reptile webserver daily version

                           Donato Ferrante

Application:  Reptile Web Server

Version:      daily version

Bug:          resources consumption

Author:       Donato Ferrante


1. Description
2. The bug
3. The code
4. The fix


1. Description:

Vendor's Description:

"Reptile is a web server made in Python. It supports server side
scripting with "Embedded Python", PHP, and CGI scripts. It has an
integrated HTML/XML validator that checks the pages before publication
and others handy features."


2. The bug:

The program doesn't well manage the user input string.
In fact it waits the HTTP version. So an attacker can consume a lot of
CPU resources, sending crafted strings.


3. The code:

To test the vulnerability simply send to the webserver some (about 10)
strings like:

GET index.htm

without specify the HTTP* at the end of the GET request, and where
the requested file must be avaible in the public_html directory.


4. The fix:

No fix.
Reptile Web Server is no more supported.



Go to the Top of This SecurityTracker Archive Page

Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2019, LLC