TinyWeb cgi-bin Crafted HTTP GET Request DoS

This script is Copyright (C) 2003-2011 Matt North


Synopsis :

The remote web server has a denial of service vulnerability.

Description :

According to its banner, the remote version of TinyWeb has a denial
of service vulnerability. Issuing a specially crafted GET request
similar to :

GET /cgi-bin/.%00./dddd.html

can cause the server to consume large amounts of CPU time.

Solution :

Contact the vendor for a patch.

Risk factor :

High / CVSS Base Score : 7.8
(CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C)
CVSS Temporal Score : 6.8
(CVSS2#E:H/RL:OF/RC:C)
Public Exploit Available : true

Family: Web Servers

Nessus Plugin ID: 11894 ()

Bugtraq ID: 8810

CVE ID: CVE-2003-1510