IBM Websphere Large Header DoS
by Nikola Strahija on September 20th, 2002 A malicious user can issue a malformed HTTP request and cause the webserver to crash.
Vulnerable:
===========
- IBM Websphere 4.0.3 on Windows 2000 Server
Details:
========
The application does not perform proper bounds check on large HTTP
headers, and as a result the application can be crashed by a remote
user. It could not be established if this could lead to code execu-
tion.
If a request is made for a .jsp ressource (the .jsp file does not
need to exist), and the HTTP field "Host" contains 796 characters or
more, the web service will crash. Other HTTP fields are also
vulnerable if the size is increased to 4K.
The web service sometimes recovers on it's own.
Vendor URL:
===========
You can visit the vendor webpage here: http://www.ibm.com
Vendor response:
================
The vendor was notified on the 4th of June, 2002. On the 12th of July
the vendor sent us a patch for the problem. On the 19th of September
we confirmed that the patch was officially released.
Corrective action:
==================
Install PQ62144 (supercedes PQ62249). The URL is wrapped:
http://www-1.ibm.com/support/docview.wss?
rs=180&context=SSEQTP&q=PQ62144&uid=swg24001610
Author: Peter Gründl ([email protected])
