Full Disclosure mailing list archives
SV: Does the Windows AUX bug affect Web servers also?
From: "Peter Kruse" <kruse () krusesecurity dk>
Date: Wed, 9 Jul 2003 20:42:21 +0200
Hi Richard, AFAIK it can´t be done with a http://www.someserver./aux but there´re several other ways to exploit this DoS. It can be done over network shares and anywhere we include HTML and scripts (webpages, e-mails, internal documents and so on). I have succesfully crashed a server placering a "COMn" reference in a special folder. We had to remove the reference with a Windows 2000 bootdisk. Other browsers are affected as well and at least two (of my knowledge) are hit a lot harder than IE. They both cause the system to crash. Med venlig hilsen // Kind regards Peter Kruse Kruse Security http://www.krusesecurity.dk -----Oprindelig meddelelse----- Fra: full-disclosure-admin () lists netsys com [mailto:full-disclosure-admin () lists netsys com] På vegne af Richard M. Smith Sendt: 9. juli 2003 18:50 Til: full-disclosure () lists netsys com Emne: [Full-Disclosure] Does the Windows AUX bug affect Web servers also? Is it possible to also crash a Web server hosted on a Windows box using a URL something like: http://www.somebody.com/aux If this particular URL is okay, maybe there are other URLs that will cause a crash. For example, POSTing a form to a URL containing AUX. This problem could be in any Windows Web server such as IIS, Apache, ColdFusion, etc.. (I don't have access to a Windows Web server to try this out myself.) Richard -----Original Message----- From: full-disclosure-admin () lists netsys com [mailto:full-disclosure-admin () lists netsys com] On Behalf Of xc3ed () phreaker net Sent: Wednesday, July 09, 2003 7:39 AM To: full-disclosure () lists netsys com Cc: KF Subject: Re: [Full-disclosure] Internet Explorer 6 DoS Bug duplicated in Windows 2003 Server, datacenter edition, IE v6.0.3790.0 regards, xsr _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- Internet Explorer 6 DoS Bug fabian . becker2 (Jul 07)
- Re: Internet Explorer 6 DoS Bug KF (Jul 07)
- RE: Internet Explorer 6 DoS Bug Joe Hummel (Jul 07)
- Re: Internet Explorer 6 DoS Bug Dave (Jul 07)
- AW: Internet Explorer 6 DoS Bug Michael Linke (Jul 07)
- Re: Internet Explorer 6 DoS Bug xc3ed (Jul 09)
- Does the Windows AUX bug affect Web servers also? Richard M. Smith (Jul 09)
- RE: Does the Windows AUX bug affect Web servers also? Gabriel Lawrence (Jul 09)
- RE: Does the Windows AUX bug affect Web servers also? Adam (Jul 09)
- SV: Does the Windows AUX bug affect Web servers also? Peter Kruse (Jul 09)
- Re: Does the Windows AUX bug affect Web servers also? jelmer (Jul 10)
- Re: Does the Windows AUX bug affect Web servers also? morning_wood (Jul 09)
- Re: Does the Windows AUX bug affect Web servers also? Matthew Murphy (Jul 09)
- Re: Does the Windows AUX bug affect Web servers also? morning_wood (Jul 10)
- RE: Internet Explorer 6 DoS Bug Joe Hummel (Jul 07)
- Re: Internet Explorer 6 DoS Bug KF (Jul 07)
- Re: Internet Explorer 6 DoS Bug madsaxon (Jul 07)
- Re: Internet Explorer 6 DoS Bug Nik Reiman (Jul 07)