PT-2008-6538 · Netwin · Netwin Smsgate

Luigi Auriemma · Publicado 2008-12-11 · Atualizado 2008-12-12 · CVE-2008-5421

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions NetWin SmsGate versions 1.1n and earlier

Description The issue affects the SSL web administration service, allowing remote attackers to cause a denial of service (hang) through several methods, including:

• a large integer in the Content-Length HTTP header,
• an invalid value in the Content-Length HTTP header, such as a negative integer,
• or a missing Content-Length HTTP header.

Recommendations For NetWin SmsGate versions 1.1n and earlier, consider restricting access to the SSL web administration service until a fix is available. As a temporary workaround, implement validation checks on the Content-Length HTTP header to prevent large, invalid, or missing values.

Exploit

Correção

Enumeração de Fraquezas

CWE-399

Identificadores relacionados

CVE-2008-5421

Produtos afetados

Netwin Smsgate

Referências · 4

• 🔥 http://aluigi.altervista.org/adv/smsgheit-adv.txt · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-5421 · Nota de Segurança
• http://securityfocus.com/bid/28048 · Nota
• http://secunia.com/advisories/29149 · Aviso do Fabricante