tomcat multiple content-length header poisioning

Jakarta Tomcat 5.0.19 Coyote/1.1 and Tomcat 4.1.24 Coyote/1.0 allows remote attackers to poison the web cache, bypass web application firewall protection, and conduct XSS attacks via an HTTP request with both a "Transfer-Encoding: chunked" header and a Content-Length header, which causes Tomcat t...

Firefly Media Server ws_getpostvars Function Content-Length Header HTTP Request Handling Overflow

The remote host is running Firefly Media Server, also known as mt-daapd, a media streaming server. The version of Firefly Media Server installed on the remote host apparently fails to sanitize user-supplied Content-Length field before using it to the call to 'malloclen+1' in 'src/webserver.c'...

Firefly媒体服务器畸形Content-Length字段堆溢出漏洞

BUGTRAQ ID: 28860 CVECAN ID: CVE-2008-1771 Firefly是Roku SoundBridge和iTunes所使用的开源媒体服务器。 Firefly的src/webserver.c文件的wsgetpostvars函数中存在堆溢出漏洞，如果远程攻击者向服务区发送了带有负数Content-Length值的POST请求的话就可以触发这个溢出，导致拒绝服务或执行任意指令。 以下是src/webserver.c文件中的漏洞代码： 707 int wsgetpostvarsWSCONNINFO pwsc 708 char contentlength; 709...

mt-daapd -- integer overflow

FrSIRT reports: A vulnerability has been identified in mt-daapd which could be exploited by remote attackers to cause a denial of service or compromise an affected system. This issue is caused by a buffer overflow error in the wsgetpostvars function when processing a negative Content-Length: head...

Integer overflow

Integer overflow in the wsgetpostvars function in Firefly Media Server formerly mt-daapd 0.2.4.1 0.9r1696-1.2 on Debian allows remote attackers to cause a denial of service crash and possibly execute arbitrary code via an HTTP POST request with a large Content-Length...

CVE-2008-1771

CVE-2008-1771 describes an integer overflow in ws_getpostvars in mt-daapd (Firefly Media Server) v0.2.4.1 and related builds, triggered by a large HTTP POST Content-Length. This can cause a heap buffer overflow with potential remote code execution, alongside denial of service. Connected advisorie...

Neat weblog 0.2 (articleId) Remote SQL Injection Vulnerability

Exploit for unknown platform in category web applications ============================================================== Neat weblog 0.2 articleId Remote SQL Injection Vulnerability ============================================================== !/usr/bin/perl Neat weblog 0.2 SQL Injection Exploit...

Design/Logic Flaw

The setRequestHeader method of the XMLHttpRequest object in Microsoft Internet Explorer 5.01, 6, and 7 does not block dangerous HTTP request headers when certain 8-bit character sequences are appended to a header name, which allows remote attackers to 1 conduct HTTP request splitting and HTTP...

PT-2008-3103 · Microsoft · Internet Explorer

Name of the Vulnerable Software and Affected Versions: Microsoft Internet Explorer versions 5.01 through 7 Description: The setRequestHeader method of the XMLHttpRequest object in Microsoft Internet Explorer does not block dangerous HTTP request headers when certain 8-bit character sequences are...

Microsoft IE 7 setRequestHeader()函数多个请求拆分/渗透漏洞

BUGTRAQ ID: 28379 Internet Explorer是微软发布的非常流行的WEB浏览器。 IE 7允许通过HTTP请求拆分攻击覆盖Content-Length、Host和Referer等HTTP头，导致HTTP头信息欺骗。 类似于以下javascript： ---------------------------------------------- var x=new XMLHttpRequest; x.open"POST","/"; forf=127;f255;f++ try...

CVE-2008-1267: Undefined Security Weakness

The Siemens SpeedStream 6520 router allows remote attackers to cause a denial of service web interface crash via an HTTP request to basehelpEnglish.htm with a large integer in the Content-Length field...

Null pointer dereference

The administration web interface in NetWin SurgeFTP 2.3a2 and earlier allows remote attackers to cause a denial of service daemon crash via a large integer in the Content-Length HTTP header, which triggers a NULL pointer dereference when memory allocation fails...

CVE-2008-1052

The administration web interface in NetWin SurgeFTP 2.3a2 and earlier allows remote attackers to cause a denial of service daemon crash via a large integer in the Content-Length HTTP header, which triggers a NULL pointer dereference when memory allocation fails...

SurgeFTP Content-Length参数空指针引用拒绝服务漏洞

BUGTRAQ ID: 27993 SurgeFTP是一款FTP服务程序，提供管理接口程序。 SurgeFTP的过程Web管理接口处理畸形请求数据时存在漏洞，远程攻击者可能利用此漏洞导致服务不可用。 如果客户端发送了Content-Length参数的话，SurgeFTP会试图根据这个字段所指定的数量分配内存（最多为2147483647字节），然后将数据拷贝到所生成的缓冲区。由于对分配结果缺少检查，如果无法分配所指定数量内存的话，就可能在拷贝期间触发空指针引用，导致整个服务器崩溃。 NetWin SurgeFTP = 2.3a2 厂商补丁： NetWin ------...

SurgeFTP FTP server DoS

Administration web interface Content-Length memory consumption...

NULL pointer in SurgeFTP 2.3a2

Luigi Auriemma Application: SurgeFTP http://www.netwinsite.com/surgeftp/ Versions: = 2.3a2 Platforms: Windows, Linux and Solaris Bug: NULL pointer access Exploitation: remote Date: 25 Feb 2008 Author: Luigi Auriemma e-mail: [email protected] web: aluigi.org 1 Introduction 2 Bug 3 The Code 4 Fi...

CVE-2008-1052: Improper Restriction of Operations within the Bounds of a Memory Buffer

The administration web interface in NetWin SurgeFTP 2.3a2 and earlier allows remote attackers to cause a denial of service daemon crash via a large integer in the Content-Length HTTP header, which triggers a NULL pointer dereference when memory allocation fails...

CVE-2008-0548: Undefined Security Weakness

Steamcast 0.9.75 and earlier allows remote attackers to cause a denial of service daemon crash via a large integer in the Content-Length HTTP header, which triggers a NULL dereference when malloc fails...

phpnuke80final-sql.txt

?php UNPUBLISHED RST/GHC EXPLOIT PHP Nuke sid sql injection exploit for Search module POST method - the best for version 8.0 FINAL coded by Foster & 1dt.w0lf tested on 6.0 , 6.6 , 7.9 , 8.0 FINAL versions if isset$POST'Submit' $result=sendit'CONCAT"::",aid,"::",pwd,"::"'; if...

Debian Security Advisory DSA 934-1 (pound)

The remote host is missing an update to pound announced via advisory DSA 934-1. Two vulnerabilities have been discovered in Pound, a reverse proxy and load balancer for HTTP. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2005-1391: Overly long HTTP Host:...