PT-2004-3411 · Gattaca · Gattaca Server 2003

Published 2004-12-31 · Updated 2017-07-11 · CVE-2004-2519

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Gattaca Server 2003 version 1.1.10.0

Description The issue allows remote attackers to cause a denial of service, specifically CPU consumption, by manipulating directory specifiers in the LANGUAGE parameter. This can be achieved by accessing certain API endpoints, such as "index.tmpl" and "web.tmpl", with specific directory specifiers, including (a) slash "/", (b) backslash "", (c) dot ".", (d) dot dot "..", and (e) internal slash "lang//en".

Recommendations For Gattaca Server 2003 version 1.1.10.0, consider restricting access to the LANGUAGE parameter in the affected API endpoints "index.tmpl" and "web.tmpl" to prevent CPU consumption denial of service attacks. As a temporary workaround, avoid using the specified directory specifiers in the LANGUAGE parameter until a patch is available.

Exploit

Fix

Related Identifiers

CVE-2004-2519

Affected Products

Gattaca Server 2003

References · 9

• 🔥 http://secunia.com/advisories/12071 · Exploit
• 🔥 https://exploit-db.com/exploits/24282 · Exploit
• 🔥 http://members.lycos.co.uk/r34ct/main/Gattaca%20Server%202003.txt · Exploit
• 🔥 http://osvdb.org/7923 · Exploit
• 🔥 http://securitytracker.com/id?1010703 · Exploit
• 🔥 http://securityfocus.com/bid/10728 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2004-2519 · Security Note
• http://gattaca-server.com/cgi-bin/yabb/YaBB.pl?board=gattaca_discussion%3Baction=display%3Bnum=1091194176%3Bstart=0#0 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/16700 · Note