* TVMOBiLi media server 126.96.36.19957 and probably prior version
2 remote DoS vulnerabilities have been discovered in TVMOBiLi Media server, which could be exploited to crash remote server with malicious HTTP requests.
1) Improper Handling of Length Parameter Inconsistency in TVMOBiLi: CVE-2012-5451
1.1 The vulnerability exists due to improper handling of URI length within the "HttpUtils.dll" dynamic-link library. A
remote attacker can send a specially crafted HTTP GET request of 161, 257 or 255 characters long to 30888/TCP port
(default TVMOBiLi's server port) and cause a stack-based buffer overrun that will crash tvMobiliService service.
0x78abe28e jnc 0x78abe2f9
0x78abe292 and fs:[eax],al
0x78abe296 test byte [ecx+0xc],0x40
Proof of Concept
The following HTTP GET request will crash vulnerable tvMobiliService service remotely:
User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)
1.2 The vulnerability exists due to improper handling of URI length within the "HttpUtils.dll" dynamic-link library. A
remote attacker can send a specially crafted HTTP HEAD request of 255, 257 or 260 characters long to 30888/TCP port and
cause a stack-based buffer overrun that will crash tvMobiliService service.
MSVCR100.dll:78abe2ad mov [edx], al from thread 1745 caused access violation when attempting to write to 0x0170e000