MS-DOS Device Name Denial Of Service Vulnerability in Abyss Web Server X1 for Windows
R00tCr4ck <[email protected]>
| Newsgroups | gmane.comp.security.vulnerabilities.watch.announce,gmane.comp.security.bugtraq,gmane.comp.security.news.securitytracker |
|---|---|
| Message-ID | <[email protected]> |
##################################### # CHT Security Research Center-2004 # # http://www.CyberSpy.Org # # Turkey # ##################################### Software: Abyss Web Server X1 for Windows Web Site: http://www.aprelium.com/ Affected Version(s): X1 Description: Abyss Web Server X1 is a free personal web server available for Windows, MacOS X, Linux, and FreeBSD operating systems. Official Description from the web site: "Abyss Web Server is based on the APX architecture. APX, which stands for Anti-crash Protection eXtension, was created, here at Aprelium, to make the server crash-proof. If it happens that the software causes a critical error and crashes (which is by the way very improbable), a report will be generated if possible and the server is automatically restarted. The downtime in such a case won't last more than 1 second! Anti-crash protection system guarantees 100% uptime!" There is MS-DOS Device Name Denial Of Service Vulnerability in Abyss Web Server X1 for Windows: It is possible to remotely crash a system running Abyss Web Server X1 by submitting URL requests for a MS-DOS devicename such as con,prn,aux in the cgi-bin folder (cgi-bin directory comes with default installation)A restart of the server service is required in order to gain normal functionality. Example: http://[victim]/cgi-bin/prn ---- Reported By R00tCr4ck at October,20 2004 root(at)CyberSpy.Org Original Article can be found at: http://www.CyberSpy.Org