what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

Oxide Webserver 2.0.4 Denial Of Service

Oxide Webserver 2.0.4 Denial Of Service
Posted Jul 20, 2012
Authored by Antu Sanadi | Site secpod.com

Oxide Webserver versions 2.0.4 and below suffer from a remote denial of service vulnerability.

tags | exploit, remote, denial of service
SHA-256 | 78053e16329204d000b42f631dfb570dbbbb076108666340fe38090874ae6db5

Oxide Webserver 2.0.4 Denial Of Service

Change Mirror Download
##############################################################################
#
# Title : Oxide Webserver Remote Denial of Service Vulnerability
# Author : Antu Sanadi SecPod Technologies (www.secpod.com)
# Vendor : http://sourceforge.net/projects/oxide/
# Advisory : http://secpod.org/blog/?p=516
# : http://secpod.org/advisories/SecPod_Oxide_WebServer_DoS_Vuln.txt
# Software : Oxide Webserver v2.0.4 and prior.
# Date : 29/06/2012
#
###############################################################################

SecPod ID: 1043 24/01/2012 Issue Discovered
19/06/2012 Vendor Notified
No Response from vendor
18/07/2012 Advisory Released


Class: Denial of Service Severity: High


Overview:
---------
Oxide Webserver v2.0.4 is prone to a remote Denial of Service vulnerability
as it fails to handle crafted requests from the client properly.


Technical Description:
----------------------
The vulnerability is caused by an error in handling some crafted characters
in HTTP GET requests, which causes the server to crash.


Impact:
--------
Successful exploitation could allow an attacker to crash a vulnerable server.


Affected Software:
------------------
Oxide Webserver version 2.0.4 and prior.


Tested on,
Oxide Webserver version 2.0.4 on Windows XP SP3


References:
-----------
http://secpod.org/blog/?p=516
http://sourceforge.net/projects/oxide
http://sourceforge.net/projects/oxide-ws/files
http://secpod.org/advisories/SecPod_Oxide_WebServer_DoS_Vuln.txt


Proof of Concept:
----------------
http://www.example.com:80/?.
http://www.example.com:80/<.
http://www.example.com:80/$.
http://www.example.com:80/cc.


Solution:
----------
Not available


Risk Factor:
-------------
CVSS Score Report:
ACCESS_VECTOR = NETWORK
ACCESS_COMPLEXITY = LOW
AUTHENTICATION = NONE
CONFIDENTIALITY_IMPACT = NONE
INTEGRITY_IMPACT = NONE
AVAILABILITY_IMPACT = COMPLETE
EXPLOITABILITY = PROOF_OF_CONCEPT
REMEDIATION_LEVEL = UNAVAILABLE
REPORT_CONFIDENCE = CONFIRMED
CVSS Base Score = 7.8 (High) (AV:N/AC:L/Au:N/C:N/I:N/A:C)


Credits:
--------
Antu Sanadi of SecPod Technologies has been credited with the discovery of this
vulnerability.
Login or Register to add favorites

File Archive:

September 2022

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Sep 1st
    23 Files
  • 2
    Sep 2nd
    12 Files
  • 3
    Sep 3rd
    0 Files
  • 4
    Sep 4th
    0 Files
  • 5
    Sep 5th
    10 Files
  • 6
    Sep 6th
    8 Files
  • 7
    Sep 7th
    30 Files
  • 8
    Sep 8th
    14 Files
  • 9
    Sep 9th
    26 Files
  • 10
    Sep 10th
    0 Files
  • 11
    Sep 11th
    0 Files
  • 12
    Sep 12th
    5 Files
  • 13
    Sep 13th
    28 Files
  • 14
    Sep 14th
    15 Files
  • 15
    Sep 15th
    17 Files
  • 16
    Sep 16th
    9 Files
  • 17
    Sep 17th
    0 Files
  • 18
    Sep 18th
    0 Files
  • 19
    Sep 19th
    12 Files
  • 20
    Sep 20th
    15 Files
  • 21
    Sep 21st
    20 Files
  • 22
    Sep 22nd
    13 Files
  • 23
    Sep 23rd
    12 Files
  • 24
    Sep 24th
    0 Files
  • 25
    Sep 25th
    0 Files
  • 26
    Sep 26th
    30 Files
  • 27
    Sep 27th
    27 Files
  • 28
    Sep 28th
    8 Files
  • 29
    Sep 29th
    14 Files
  • 30
    Sep 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By
Rokasec
close