PT-2002-1904 · New Atlanta · Servletexec Isapi

Published 2002-08-31 · Updated 2008-09-05 · CVE-2002-0894

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions: NewAtlanta ServletExec ISAPI version 4.1

Description: The issue allows remote attackers to cause a denial of service, resulting in a crash. This can be achieved by sending a request for a long .jsp file or a long URL directly to the com.newatlanta.servletexec.JSP10Servlet endpoint.

Recommendations: For NewAtlanta ServletExec ISAPI version 4.1, consider restricting access to the com.newatlanta.servletexec.JSP10Servlet endpoint to minimize the risk of exploitation. Additionally, limiting the length of .jsp files and URLs that can be processed may help mitigate the issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2002-0894

Affected Products

Servletexec Isapi

References · 6

• 🔥 http://securityfocus.com/bid/4796 · Exploit
• 🔥 https://exploit-db.com/exploits/21471 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2002-0894 · Security Note
• http://iss.net/security_center/static/9141.php · Vendor Advisory
• http://archives.neohapsis.com/archives/vulnwatch/2002-q2/0077.html · Note
• http://online.securityfocus.com/archive/1/273615 · Note