Denial of Service Vulnerability in Xeneo Web Server
5 Nov. 2002
Summary
Northern Solutions' Xeneo Web Server is a "fast, compact web server that makes it easy to set up and administer a web site on the Windows platform." A denial of service vulnerability has been discovered in the product.
Vulnerable systems:
* Xeneo versions 2.1.0.0 (PHP version) and 2.0.759.6
Immune systems:
* Xeneo version 2.1.5 and above
Due to the improper handling of a specially crafted web request, remote attackers may launch a denial of service attack against the PHP version of Xeneo. The condition is triggered when the web server receives a request for '%'. Upon successful exploitation, the web server will crash with a Microsoft Visual C++ runtime error message. The following is an example attack URL: http://target.server/%
Analysis:
Any remote user with access to the application can launch this attack, thereby denying legitimate users access to the server and the contents and/or additional services provided.
Workaround:
Use a filtering web proxy server to help mitigate against exploitation.
Disclosure timeline:
10/06/2002 Issue disclosed to iDEFENSE
10/31/2002 Author notified
10/31/2002 iDEFENSE clients notified
10/31/2002 Response received from Robert Shanahan
11/04/2002 Public disclosure
