Ziv Kamir has reported two vulnerabilities in Sami HTTP Server, which can be exploited by malicious people to disclose sensitive information or cause a DoS (Denial of Service).

1) An input validation error makes it possible to access arbitrary files outside the web root via directory traversal attacks.

2) A NULL pointer dereference error when processing received data can be exploited to crash the web service by connecting to it and only send two carriage returns and linefeeds ("\r\n\r\n").

The vulnerabilities have been confirmed in version 1.0.5. Other versions may also be affected.

Solution
Use another product.

Provided and/or discovered by
Ziv Kamir, GSS-IT.

Changelog
Further details available in Customer Area

Deep Links
Links available in Customer Area