UltraBoard拒绝服务漏洞

漏洞ID	1105821	漏洞类型	输入验证
发布时间	2000-05-05	更新时间	2005-05-02
CVE编号	CVE-2000-0426	CNNVD-ID	CNNVD-200005-030
漏洞平台	CGI	CVSS评分	5.0

|漏洞来源

https://www.exploit-db.com/exploits/19899
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200005-030

|漏洞详情

UltraBoard1.6和其他版本存在漏洞，远程攻击者可以通过在Session参数中引用UltraBoard，导致UltraBoard创建自身进程的拷贝，触发拒绝服务。

|漏洞EXP

source: http://www.securityfocus.com/bid/1175/info

UltraBoard 1.6 (and possibly all 1.x versions and the new beta Ultraboard 2000) are vulnerable to this Denial of Service attack.

A remote user is able to expend all of the available resources of the webserver by using a specially-devised request to the CGI. This request causes a fork, which will then consume the processor time and memory of the server.

http:://target/ultraboard.pl?request=Session=../UltraBoard.pl%00%7c

|参考资料

来源:BID
名称:1175
链接:http://www.securityfocus.com/bid/1175
来源:BUGTRAQ
名称:20000505Re:FunwithUltraBoardV1.6X
链接:http://archives.neohapsis.com/archives/bugtraq/2000-05/0059.html

相关推荐: UltraBoard Directory Traversal Vulnerability

UltraBoard Directory Traversal Vulnerability 漏洞ID 1104156 漏洞类型 Input Validation Error 发布时间 2000-05-03 更新时间 2000-05-03 CVE编号 N/A CN…