PT-2008-6538 · Netwin · Netwin Smsgate

Luigi Auriemma · Published 2008-12-11 · Updated 2008-12-12 · CVE-2008-5421

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions NetWin SmsGate versions 1.1n and earlier

Description The issue affects the SSL web administration service, allowing remote attackers to cause a denial of service (hang) through several methods, including:

• a large integer in the Content-Length HTTP header,
• an invalid value in the Content-Length HTTP header, such as a negative integer,
• or a missing Content-Length HTTP header.

Recommendations For NetWin SmsGate versions 1.1n and earlier, consider restricting access to the SSL web administration service until a fix is available. As a temporary workaround, implement validation checks on the Content-Length HTTP header to prevent large, invalid, or missing values.

Exploit

Fix

Weakness Enumeration

CWE-399

Related Identifiers

CVE-2008-5421

Affected Products

Netwin Smsgate

References · 4

• 🔥 http://aluigi.altervista.org/adv/smsgheit-adv.txt · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-5421 · Security Note
• http://secunia.com/advisories/29149 · Vendor Advisory
• http://securityfocus.com/bid/28048 · Note