OpenProjects IRCD Allows DNS Spoofing 2. Cisco PIX Firewall Authentication Denial of Service 3. Oracle Application Server Discloses Full Path for Missing JSP Files 4. Lotus Notes API Unauthorized Access to File Attachments 5. DoS Summary The Websweeper application from Baltimore Technologies is vulnerable to a Denial of Service attack.
Malicious usage can lead to the application crashing.
By sending an infinitely long HTTP request through the Websweeper application, it is possible to cause it to consume all available memory on the server and eventually have the operating system kill the process. The point is to use up all available buffer memory in the application, and if this buffer is not restricted, cause the application to be killed by the operating system. The concept works on many HTTP applications, and the idea came from reading one of Marc Maiffrets posts to Bugtraq and this really goes far beyond just the Websweeper application. Keep filling in a's. The HTTP request will then be buffered and the a's will be pushed to the application and memory will be allocated to handle the beginning request.