CVE-2004-0276 The get_real_string function in Monkey HTTP Daemon (monkeyd) 0.8.1 and earlier allows remote attackers to cause a denial of service (crash) via an HTTP request with a sequence of "%" characters and a....
MediumCVSS 5.0
EPSS 3.7%
PoC
- Published
- Updated
- Exploit status
- Proof-of-concept only
Description
The get_real_string function in Monkey HTTP Daemon (monkeyd) 0.8.1 and earlier allows remote attackers to cause a denial of service (crash) via an HTTP request with a sequence of "%" characters and a missing Host field.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| monkey-project monkey | <= 0.8.1 | No fix listed |
| monkey-project monkey | = 0.1.1 | No fix listed |
| monkey-project monkey | = 0.5.2 | No fix listed |
| monkey-project monkey | = 0.6.0 | No fix listed |
| monkey-project monkey | = 0.6.1 | No fix listed |
| monkey-project monkey | = 0.6.2 | No fix listed |
| monkey-project monkey | = 0.6.3 | No fix listed |
| monkey-project monkey | = 0.7.0 | No fix listed |
| monkey-project monkey | = 0.7.1 | No fix listed |
| monkey-project monkey | = 0.7.2 | No fix listed |
| monkey-project monkey | = 0.8.0 | No fix listed |
References
- aluigi.altervista.org
- 20040211 Denial of Service in Monkey httpd <= 0.8.1 mailing-list
- monkeyd.sourceforge.net
- 3921 vdb-entry
- 9642 exploit patch vdb-entry vendor-advisory
- monkey-getrealstring-dos(15187) vdb-entry