Secunia

A vulnerability has been reported in Abyss Web Server, which potentially can be exploited by malicious people to compromise a vulnerable web server.

The vulnerability is caused due to a boundary error when handling HTTP requests. This can be exploited by sending an overly long, specially crafted request, which can cause a heap overflow and allow arbitrary code execution with the privileges of the web service.

Example:
GET /AAAA...[2048]...AAAA:\ HTTP/1.0

It has futhermore been reported that it is possible to insert arbitrary headers due to an input validation error in the "Location:" header returned in a "302 Found" page. This can be exploited by including the ASCII representations "%0D" (carriage return), "%0A" (linefeed), and "%20" (space) in an URL.

The vulnerability has been reported in version 1.1.2. However, other versions may also be affected.

Solution
Reportedly, the vulnerability has been fixed in version 1.1.6 BETA:
Further details available in Customer Area

Provided and/or discovered by
Fozzy

Deep Links
Links available in Customer Area