[Am-info] Microsoft IIS False Content-Length Field DoS Vulnerability

[Fred A. Miller]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Microsoft IIS False Content-Length Field DoS Vulnerability
BugTraq ID: 3667
Remote: Yes
Date Published: Dec 11 2001 12:00A
Relevant URL:
http://www.securityfocus.com/bid/3667
Summary:

Microsoft IIS 5.0 may be prone to a denial of service condition when 
sent a specially crafted malformed HTTP GET header.

If an IIS 5.0 web server is sent a crafted HTTP GET request which 
contains a falsified and excessive "Content-Length" field, it behaves 
in an unusual manner. The server keeps the connection open and does not 
time out, but does not respond otherwise. It is possible that this may 
be used to cause a denial of service to the web server.

If this unexpected behavior can somehow be exploited to cause a denial 
of service, then the server will need to be restarted to regain normal
functionality.

- -- 
Fred A. Miller
Systems Administrator
Cornell Univ. Press Services
fm@cupserv.org

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (GNU/Linux)
Comment: For info see http://www.gnupg.org

iD8DBQE8HnB7IhTtc6nTZIIRAgEhAJ4u2Rzh1E50h2qbBDPMeLOlXkMnhwCggcbt
NVlsRehUW5f2jaBULMwM0vo=
=nGPv
-----END PGP SIGNATURE-----