Small HTTP Server 2.0 1 - Non-Existent File Denial of Service

Author: 403-security team
type: dos
platform: windows
port: 
date_added: 2000-11-14 
date_updated: 2012-08-10 
verified: 1 
codes: CVE-2000-0897;OSVDB-1643 
tags: 
aliases:  
screenshot_url:  
application_url: 

source : https://www.securityfocus.com/bid/1941/info


Small HTTP Server is a full service web server. This utility is less than 30Kb and requires minimal system resources.

Small HTTP Server is subject to a denial of service. When making an http request without a filename specified the server will attempt to locate index.html in that particular directory, if index.html does not exist the server will utilize a large amount of system memory . If numerous http requests, again structured without a filename, are sent to the web server, an attacker could cause the server to consume all system memory. A restart of the application is required in order to gain normal functionality.

http://target/subdirectory/