Problems with sig 5307 - Mercantec Softcart Overflow

[DSmirnov]

Looks like this one is looking for SoftCart.exe in HTTP request but doesn't pay attention if it is GET field or other field (e.g Referer:).

For example will react on payload below:

Payload: peg, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, application/x-shockwave-flash, */* Referer: http://www.latoys.com/cgi-bin/SoftCart.exe/lego/lego_dinosaurs.html?E+scstore Accept-Language: en-ca Connection: Keep-Alive

[craiwill]

5307 is searching in the URI field for a request to /cgi-bin/softcart.exe with total request length over 500. The URI field in service.http is defined as anything from the GET to the next CRLF. This prevents the situation you are describing since the get is terminated by a CRLF.