|
|
|
|
| |
| IBM HTTP Server (IHS) powered by Apache is based on the Apache HTTP Server, which is the most popular server on the Web. This HTTP Server runs on AIX, Solaris, Windows NT, HP-UX, and Linux. A security vulnerability in the product allows remote attackers to launch a denial of service attack on the server by sending a large amount of '.' (dots) in a HTTP URL request. |
| |
Credit:
The information has been provided by benjurry.
|
| |
Vulnerable systems:
IBM HTTP Server 1.3.6
Immune systems:
IBM HTTP Server 1.3.12
On an unpatched IBM HTTP Server, if you request an HTTP GET with the filename of the sort of:
/......(move than 216 ".")aaa
The server (in this case it was running on a Windows NT system) will respond with a BSOD displaying the following message:
***STOP:0x0000001e(0X00000005,0X804B3A51,0X00000000,0X00000000)KMODE_EXCEPTI ON_NOT_HANDLED.
***Address 804B3A51 base at 80400000,Datastamp 384D9B17-ntoskrnl.exe
Since this is a BSOD (Blue screen of death), not all servers will automatically recover, making it necessary for an administrator to restart the server manually.
Solution:
Update to IBM HTTP Server (IHS) 1.3.12.
|
|
|
|
|
|
|
|
|
|
