CVE-2002-1052 - Jigsaw 2.2.1 on Windows systems allows remote attackers to use MS-DOS device names in HTTP requests

CVE-2002-1052

Summary

Jigsaw 2.2.1 on Windows systems allows remote attackers to use MS-DOS device names in HTTP requests to (1) cause a denial of service using the "con" device, or (2) obtain the physical path of the server using two requests to the "aux" device.

References

Vulnerable Configurations

cpe:2.3:a:w3c:jigsaw:2.2.1:*:*:*:*:*:*:*
cpe:2.3:a:w3c:jigsaw:2.2.1:*:*:*:*:*:*:*

CVSS

Base:	5.0 (as of 18-10-2016 - 02:23)
Impact:
Exploitability:

CWE

NVD-CWE-Other

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	LOW	NONE

Impact

Confidentiality	Integrity	Availability
NONE	NONE	PARTIAL

cvss-vector via4

AV:N/AC:L/Au:N/C:N/I:N/A:P

refmap via4

bid	5251 5258
bugtraq	20020717 KPMG-2002031: Jigsaw Webserver Path Disclosure 20020717 KPMG-2002034: Jigsaw Webserver DOS device DoS
vulnwatch	20020717 [VulnWatch] KPMG-2002031: Jigsaw Webserver Path Disclosure 20020717 [VulnWatch] KPMG-2002034: Jigsaw Webserver DOS device DoS
xf	jigsaw-aux-path-disclosure(9586) jigsaw-dos-device-dos(9587)

Last major update

18-10-2016 - 02:23

Published

04-10-2002 - 04:00

Last modified

18-10-2016 - 02:23