Pi3Web Webserver v2.0 Buffer Overflow
source: http://www.securityspace.com/smysecu....html?id=11099
Pi3Web Webserver v2.0 Buffer Overflow
ID: 11099
Category: Denial of Service
URL: http://www.securityspace.com/smysecu....html?id=11099
Summary: Tests for a DoS in Pi3Web
Description:
The remote server may crash when it is sent
a very long cgi paramater multiple times, as in :
GET /cgi-bin/hello.exe?AAAAA[...]AAAA
An attacker may use this flaw to prevent the remote
host from working properly.
Solution: upgrade to version 2.0.1 of Pi3Web
Risk factor: High
From zimpel ( Holger Zimmermann )
Description: By sending a request to a CGI program, which contains a certain number of dots, the server may crash.
Date: 02/2002
References:
http://online.securityfocus.com/archive/1/250126
http://online.securityfocus.com/bid/3866
Versions: Pi3Web 2.0.0 beta 1 and 2
Platforms: Win32
Reproducible: Yes, the mapped physical path must contain exactly 260 (PATH_MAX) characters, try e.g. http://host/cgi-bin/ hello.exe...<about 224 chars>.
Status: Solved
Workaround: Yes, add the following to configuration object 'Scripts' e.g. in Config.pi3 -
<Object>
Name Scripts
Class FlexibleHandlerClass
Condition "&cmp(&dblookup(response,string,ObjectMap),Scripts)"
# line added to check for script names ending on '.'
CheckPath Condition="®exp(*.,$z)" StatusCode StatusCode="404"
.
.
.
Fix: Fixed in Pi3Web 2.0.0 release, don't use the beta 1 and 2 anymore.
upgrade available at http://pi3web.sourceforge.net/pi3web/
make sure you have the latest stable version running.
