Monit fails to properly handle HTTP requests containing a negative Content-Length field.
Monit is a utility to monitor system processes, files, directories, devices, and remote hosts. It provides a web-based interface that can be used to access the Monit server. When processing HTTP requests, Monit fails to properly sanitize the Content-Length field. By supplying a negative value for the Content-Length field of an HTTP request, an unauthenticated, remote attacker could cause the Monit daemon to crash.
A remote, unauthenticated attacker could cause the Monit daemon to crash, resulting in a denial-of-service condition.
Upgrade to Monit version 4.1.1 or later.
Filter by status: All Affected Not Affected Unknown
Filter by content: __ Additional information available
__ Sort by: Status Alphabetical
Updated: April 06, 2004
We have not received a statement from the vendor.
The vendor has not provided us with any further information regarding this vulnerability.
Please refer to the Monit changelog.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Group | Score | Vector
Base | |
Temporal | |
Environmental | |
This vulnerability was reported by Evgeny Legerov of S-Quadra.
This document was written by Damon Morda.
CVE IDs: | None
Severity Metric: | 1.27
Date Public: | 2004-03-31
Date First Published: | 2004-04-06
Date Last Updated: | 2004-04-06 14:14 UTC
Document Revision: | 16