Type

DoS, crashes Daemon

Release Date

January 15, 2002

Product / Vendor

BSoft ZBServer Pro is an Internet and Intranet server that supports HTTP, Gopher, FTP and Chat Services. ZBServer is available for Microsoft Windows operating systems.

http://www.zbserver.com

Summary

ZBServer Pro 1.5 has an unchecked buffer in the code that handles GET requests. This weakness allows for the execution of arbitrary code.

http://host/AAAAAAAAA...(Ax2500)...AAA

Tested

Windows 2000 / ZBServer Pro 1.50-r13

Vulnerable

ZBServer Pro 1.50-r13 (And may be other)

Disclaimer

http://www.securityoffice.net is not responsible for the misuse or illegal use of any of the information and/or the software listed on this security advisory.

Author

Tamer Sahin
ts(at)securityoffice.net
http://www.securityoffice.net