VisNetic WebSite Denial of Service
From: Peter Kruse (kruse@KRUSESECURITY.DK)
Date: 12/13/02
- Previous message: Russ: "2 mistaken approvals to the list"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Date: Fri, 13 Dec 2002 09:25:00 +0100 From: Peter Kruse <kruse@KRUSESECURITY.DK> To: NTBUGTRAQ@LISTSERV.NTBUGTRAQ.COM
Name: VisNetic WebSite Denial of Service
Date: 12th of December 2002
Software affected: VisNetic WebSite 3.5.13.1
(prior versions are vulnerable)
Advisory: http://www.krusesecurity.dk/advisories/vis0102.txt
Vendor:
http://www.deerfield.com/support/visnetic_website/releasenotes/
Risk: Medium
Legal Notice:
This Advisory is copyright by Peter Kruse.
You may distribute this unmodified.
Disclaimer:
The opinions expressed in this advisory are my own and not that of any
company.
The usual standard disclaimer applies, especially the fact that Peter
Kruse
or Kruse Security is not liable for any damages caused by direct or
indirect
use of the information or functionality provided by this advisory or
program.
Vendor Description:
VisNetic Website, the first web server developed specifically for
Windows,
can use almost any development platform, and includes features that
allow web
developers to create powerful, flexible web sites. VisNetic WebSite is a
secure
Windows-based web server that supports multiple domains, and allows
TLS/SSL
secured domains. This web server also includes support for a user
database that
can restrict access to content, and is immune to many of the security
issues
that may arise with other popular web servers.
Problem:
During a trial installation of the Visnetic website package I discovered
a bug
in the software that would crash the server on handling special
longsized URLs.
The server is subject to a Denial of Service attack. The weakness could
allow
a malicous attacker to send an oversized packet to the server which will
effect
a Denial of Service to the application.
Description:
The flaw can be exploited with the /OPTIONS.
With a "OPTIONS /AAAAAAA.HTML" approx. 5001 A's you can send data to the
webserver
and crash the application. The server will crash with an instruction
(write) fault
at 0x00417d54 pointing to 0x41414141 in the httpd32.exe application.
This weakness
has been verified by testing against the latest website software from
Deerfield
(v3.5.13.1).
It should be noted that an attack will still be caught in the log file
for
inspection by a company attacked by this long URL.
Solution:
Update your VisNetic Website to version 3.5.15.
Credit:
I would like to thank Deerfield for quick and very professional handling
of the
reported issue. An update has been released and can be downloaded from
Deerfield's
web site at:
http://www.deerfield.com/download/visnetic_website/
The update can also be downloaded from the Visnetic WebSite
administration console,
support tab, check for updates (at the bottom of the tab).
Kind regards
Peter Kruse
Kruse Security
http://www.krusesecurity.dk
oooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo
Delivery co-sponsored by TruSecure Corporation
oooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo
Demonstrate your knowledge and understanding of core IT Security, become
TICSA certified.
Are you responsible for IT security in job function, but not necessarily
in title? Do you want to prove your IT security knowledge and increase
opportunities? Interested? Visit;
http://www.trusecure.com/solutions/certifications/ticsa/
for more information.
oooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo
- Next message: Russ: "Re: 2 mistaken approvals to the list - not viruses"
- Previous message: Russ: "2 mistaken approvals to the list"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
|
