VAR-200507-0116

Vulnerability from variot - Updated: 2023-12-18 13:40

Apple Darwin Streaming Server 5.5 and earlier allows remote attackers to cause a denial of service (application crash) via a URL with a filename containing a .cgi extension and an MS-DOS device name such as AUX, CON, PRN, COM1, or LPT1, a different vulnerability than CVE-2003-0421 and CVE-2003-0502. Darwin Streaming Server is prone to a denial-of-service vulnerability.

Bist Du interessiert an einem neuen Job in IT-Sicherheit?

Secunia hat zwei freie Stellen als Junior und Senior Spezialist in IT- Sicherheit: http://secunia.com/secunia_vacancies/

TITLE: Apple Darwin Streaming Server Web Admin Denial of Service

SECUNIA ADVISORY ID: SA16056

VERIFY ADVISORY: http://secunia.com/advisories/16056/

CRITICAL: Less critical

IMPACT: DoS

WHERE:

From remote

SOFTWARE: Darwin Streaming Server 5.x http://secunia.com/product/3085/

DESCRIPTION: Sowhat has reported a vulnerability in Darwin Streaming Server, which can be exploited by malicious people to cause a DoS (Denial of Service).

The vulnerability is caused due to an error in the web-based admin interface when handling HTTP requests containing MS-DOS device names with ".cgi" extension appended (e.g. AUX.cgi).

Successful exploitation causes the service to stop responding.

The vulnerability has been reported in versions 5.5 and prior for Windows.

SOLUTION: Update to version 5.5.1.

PROVIDED AND/OR DISCOVERED BY: Sowhat

ORIGINAL ADVISORY: http://secway.org/Advisory/AD20050713.txt

About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities.

Subscribe: http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/

Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.

Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

Show details on source website
To clipboard 

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-200507-0116",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "darwin streaming server",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "apple",
        "version": "5.5"
      },
      {
        "model": "darwin streaming server",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "apple",
        "version": "5.5"
      }
    ],
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2005-2195"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200507-202"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:apple:darwin_streaming_server:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndIncluding": "5.5",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2005-2195"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Sowhat  smaillist@gmail.com",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-200507-202"
      }
    ],
    "trust": 0.6
  },
  "cve": "CVE-2005-2195",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "acInsufInfo": false,
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "NVD",
            "availabilityImpact": "PARTIAL",
            "baseScore": 5.0,
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 10.0,
            "impactScore": 2.9,
            "integrityImpact": "NONE",
            "obtainAllPrivilege": false,
            "obtainOtherPrivilege": false,
            "obtainUserPrivilege": false,
            "severity": "MEDIUM",
            "trust": 1.0,
            "userInteractionRequired": false,
            "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
            "version": "2.0"
          },
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "VULHUB",
            "availabilityImpact": "PARTIAL",
            "baseScore": 5.0,
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 10.0,
            "id": "VHN-13404",
            "impactScore": 2.9,
            "integrityImpact": "NONE",
            "severity": "MEDIUM",
            "trust": 0.1,
            "vectorString": "AV:N/AC:L/AU:N/C:N/I:N/A:P",
            "version": "2.0"
          }
        ],
        "cvssV3": [],
        "severity": [
          {
            "author": "NVD",
            "id": "CVE-2005-2195",
            "trust": 1.0,
            "value": "MEDIUM"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-200507-202",
            "trust": 0.6,
            "value": "MEDIUM"
          },
          {
            "author": "VULHUB",
            "id": "VHN-13404",
            "trust": 0.1,
            "value": "MEDIUM"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-13404"
      },
      {
        "db": "NVD",
        "id": "CVE-2005-2195"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200507-202"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Apple Darwin Streaming Server 5.5 and earlier allows remote attackers to cause a denial of service (application crash) via a URL with a filename containing a .cgi extension and an MS-DOS device name such as AUX, CON, PRN, COM1, or LPT1, a different vulnerability than CVE-2003-0421 and CVE-2003-0502. Darwin Streaming Server is prone to a denial-of-service vulnerability. \n\n----------------------------------------------------------------------\n\nBist Du interessiert an einem neuen Job in IT-Sicherheit?\n\n\nSecunia hat zwei freie Stellen als Junior und Senior Spezialist in IT-\nSicherheit:\nhttp://secunia.com/secunia_vacancies/\n\n----------------------------------------------------------------------\n\nTITLE:\nApple Darwin Streaming Server Web Admin Denial of Service\n\nSECUNIA ADVISORY ID:\nSA16056\n\nVERIFY ADVISORY:\nhttp://secunia.com/advisories/16056/\n\nCRITICAL:\nLess critical\n\nIMPACT:\nDoS\n\nWHERE:\n\u003eFrom remote\n\nSOFTWARE:\nDarwin Streaming Server 5.x\nhttp://secunia.com/product/3085/\n\nDESCRIPTION:\nSowhat has reported a vulnerability in Darwin Streaming Server, which\ncan be exploited by malicious people to cause a DoS (Denial of\nService). \n\nThe vulnerability is caused due to an error in the web-based admin\ninterface when handling HTTP requests containing MS-DOS device names\nwith \".cgi\" extension appended (e.g. AUX.cgi). \n\nSuccessful exploitation causes the service to stop responding. \n\nThe vulnerability has been reported in versions 5.5 and prior for\nWindows. \n\nSOLUTION:\nUpdate to version 5.5.1. \n\nPROVIDED AND/OR DISCOVERED BY:\nSowhat\n\nORIGINAL ADVISORY:\nhttp://secway.org/Advisory/AD20050713.txt\n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\neverybody keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. \n\n----------------------------------------------------------------------\n\nUnsubscribe: Secunia Security Advisories\nhttp://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org\n\n----------------------------------------------------------------------\n\n\n",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2005-2195"
      },
      {
        "db": "BID",
        "id": "89742"
      },
      {
        "db": "VULHUB",
        "id": "VHN-13404"
      },
      {
        "db": "PACKETSTORM",
        "id": "38651"
      }
    ],
    "trust": 1.35
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "SECTRACK",
        "id": "1014474",
        "trust": 2.0
      },
      {
        "db": "NVD",
        "id": "CVE-2005-2195",
        "trust": 2.0
      },
      {
        "db": "SECUNIA",
        "id": "16056",
        "trust": 1.8
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200507-202",
        "trust": 0.7
      },
      {
        "db": "BUGTRAQ",
        "id": "20050713 APPLE DARWIN STREAMING SERVER WEB ADMIN REMOTE DENIAL OF SERIVCE",
        "trust": 0.6
      },
      {
        "db": "BID",
        "id": "89742",
        "trust": 0.4
      },
      {
        "db": "VULHUB",
        "id": "VHN-13404",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "38651",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-13404"
      },
      {
        "db": "BID",
        "id": "89742"
      },
      {
        "db": "PACKETSTORM",
        "id": "38651"
      },
      {
        "db": "NVD",
        "id": "CVE-2005-2195"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200507-202"
      }
    ]
  },
  "id": "VAR-200507-0116",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-13404"
      }
    ],
    "trust": 0.01
  },
  "last_update_date": "2023-12-18T13:40:55.029000Z",
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "NVD-CWE-Other",
        "trust": 1.0
      }
    ],
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2005-2195"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 2.1,
        "url": "http://secway.org/advisory/ad20050713.txt"
      },
      {
        "trust": 2.0,
        "url": "http://securitytracker.com/id?1014474"
      },
      {
        "trust": 1.7,
        "url": "http://secunia.com/advisories/16056"
      },
      {
        "trust": 1.0,
        "url": "http://marc.info/?l=bugtraq\u0026m=112126999514361\u0026w=2"
      },
      {
        "trust": 0.9,
        "url": "http://marc.theaimsgroup.com/?l=bugtraq\u0026m=112126999514361\u0026w=2"
      },
      {
        "trust": 0.1,
        "url": "http://marc.info/?l=bugtraq\u0026amp;m=112126999514361\u0026amp;w=2"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/secunia_security_advisories/"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/advisories/16056/"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/secunia_vacancies/"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/product/3085/"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/about_secunia_advisories/"
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-13404"
      },
      {
        "db": "BID",
        "id": "89742"
      },
      {
        "db": "PACKETSTORM",
        "id": "38651"
      },
      {
        "db": "NVD",
        "id": "CVE-2005-2195"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200507-202"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "VULHUB",
        "id": "VHN-13404"
      },
      {
        "db": "BID",
        "id": "89742"
      },
      {
        "db": "PACKETSTORM",
        "id": "38651"
      },
      {
        "db": "NVD",
        "id": "CVE-2005-2195"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200507-202"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2005-07-18T00:00:00",
        "db": "VULHUB",
        "id": "VHN-13404"
      },
      {
        "date": "2005-07-18T00:00:00",
        "db": "BID",
        "id": "89742"
      },
      {
        "date": "2005-07-14T05:33:32",
        "db": "PACKETSTORM",
        "id": "38651"
      },
      {
        "date": "2005-07-18T04:00:00",
        "db": "NVD",
        "id": "CVE-2005-2195"
      },
      {
        "date": "2005-07-18T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-200507-202"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2016-10-18T00:00:00",
        "db": "VULHUB",
        "id": "VHN-13404"
      },
      {
        "date": "2005-07-18T00:00:00",
        "db": "BID",
        "id": "89742"
      },
      {
        "date": "2016-10-18T03:25:44.990000",
        "db": "NVD",
        "id": "CVE-2005-2195"
      },
      {
        "date": "2005-10-25T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-200507-202"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-200507-202"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Apple Darwin Streaming Server Denial of service vulnerability",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-200507-202"
      }
    ],
    "trust": 0.6
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "unknown",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-200507-202"
      }
    ],
    "trust": 0.6
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.