National Cyber-Alert System

Vulnerability Summary for CVE-2008-6938

Overview

Pi3Web 2.0.3 before PL2, when installed on Windows as a desktop application and without using the Pi3Web/Conf/Intenet.pi3, allows remote attackers to cause a denial of service (crash or hang) and obtain the full pathname of the server via a request to a file in the ISAPI directory that is not an executable DLL, which triggers the crash when the DLL load fails, as demonstrated using Isapi\users.txt.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: XF

Name: pi3web-isapi-dos(46600)

Type: Patch Information

Hyperlink:http://xforce.iss.net/xforce/xfdb/46600

External Source: BID

Name: 32287

Type: Patch Information

Hyperlink:http://www.securityfocus.com/bid/32287

External Source: BUGTRAQ

Name: 20081203 Re: Re: Re: Wrong report: BID 32287, Pi3Web ISAPI DoS vulnerability

Hyperlink:http://www.securityfocus.com/archive/1/498865

External Source: BUGTRAQ

Name: 20081201 Re: Re: Wrong report: BID 32287, Pi3Web ISAPI DoS vulnerability

Hyperlink:http://www.securityfocus.com/archive/1/498771

External Source: BUGTRAQ

Name: 20081130 Re: Re: Wrong report: BID 32287, Pi3Web ISAPI DoS vulnerability

Hyperlink:http://www.securityfocus.com/archive/1/498770

External Source: BUGTRAQ

Name: 20081124 Re: Re: Wrong report: BID 32287, Pi3Web ISAPI DoS vulnerability

Hyperlink:http://www.securityfocus.com/archive/1/498602

External Source: BUGTRAQ

Name: 20081122 Re: Wrong report: BID 32287, Pi3Web ISAPI DoS vulnerability

Hyperlink:http://www.securityfocus.com/archive/1/498575

External Source: OSVDB

Name: 49999

Hyperlink:http://www.osvdb.org/49999

External Source: OSVDB

Name: 49998

Hyperlink:http://www.osvdb.org/49998

External Source: MILW0RM

Name: 7109

Hyperlink:http://www.milw0rm.com/exploits/7109

External Source: SECUNIA

Name: 32696

Type: Advisory

Hyperlink:http://secunia.com/advisories/32696

External Source: BUGTRAQ

Name: 20081122 Wrong report: BID 32287, Pi3Web ISAPI DoS vulnerability

Hyperlink:http://archives.neohapsis.com/archives/bugtraq/2008-11/0171.html