https://www.exploit-db.com/exploits/20403
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200101-073

SmallHTTPServer2.03及其之前版本存在漏洞。远程攻击者通过重复的请求不包含index.html文件的参考目录的URL导致服务拒绝。该漏洞可导致请求结束后内存消耗并不释放。

source : http://www.securityfocus.com/bid/1941/info


Small HTTP Server is a full service web server. This utility is less than 30Kb and requires minimal system resources.

Small HTTP Server is subject to a denial of service. When making an http request without a filename specified the server will attempt to locate index.html in that particular directory, if index.html does not exist the server will utilize a large amount of system memory . If numerous http requests, again structured without a filename, are sent to the web server, an attacker could cause the server to consume all system memory. A restart of the application is required in order to gain normal functionality.

http://target/subdirectory/

来源:BID
名称:1941
链接:http://www.securityfocus.com/bid/1941
来源:BUGTRAQ
名称:20001114VulnerabilitesinSmallHTTPServer
链接:http://marc.theaimsgroup.com/?l=bugtraq&m;=97421834001092&w;=2
来源:home.lanck.net
链接:http://home.lanck.net/mf/srv/index.htm
来源:XF
名称:small-http-nofile-dos(5524)
链接:http://xforce.iss.net/static/5524.php