Cloudanix VulnDB

CVE-2013-1305

None

CVSS

—

EPSS

54.7%

Published

May 15, 2013

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Attend

A problem in certain web software lets attackers send specially made web requests that can freeze the program and stop normal operations.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Low
Impact
Denial Of Service
Component
Network Service
Class
Denial of service
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

A remote attacker can send a specially crafted HTTP header that triggers an infinite loop in the HTTP request processing component, resulting in denial of service.

Why it matters to the business

Causes service disruption and unavailability for affected systems, potentially impacting user access and operations until the service is restarted or mitigated. The vulnerability affects webkitgtk packages on Ubuntu 14.04 LTS and 16.04 LTS with many downstream dependents.

How an attack unfolds

An attacker crafts a malicious HTTP request containing a malformed header and sends it to a vulnerable server running the affected webkitgtk component, causing the HTTP handling logic to enter an infinite loop that consumes CPU resources and denies service to legitimate users. No named threat actors are associated with this issue.

How to fix it

Upgrade webkitgtk on Ubuntu 14.04 LTS to version 2.4.8-1ubuntu1~ubuntu14.04.1 and on Ubuntu 16.04 LTS to version 2.4.9-2ubuntu2. Apply patches as soon as possible given the published date of 2013-05-15 and stable EPSS score.

How to confirm the fix worked

Check installed package versions against the fixed releases and confirm the update resolves the infinite-loop condition through targeted HTTP header testing.

Typical attack path

  1. Scan for publicly reachable servers using the affected webkitgtk versions
  2. Craft an HTTP request containing the malicious header
  3. Transmit the request to trigger the infinite loop
  4. Observe resource exhaustion and service unavailability

How to detect it

Review web server and system logs for repeated malformed header entries or sudden spikes in CPU usage tied to HTTP processing; no specific post-exploitation artifacts are typically left by this denial-of-service condition.

What your security team should do

  • Apply the listed fixed package versions immediately across all affected Ubuntu systems
  • Implement network-level request filtering or rate limiting for HTTP traffic
  • Monitor system logs for sustained high CPU usage on HTTP-handling processes

The record

HTTP.sys in Microsoft Windows 8, Windows Server 2012, and Windows RT allows remote attackers to cause a denial of service (infinite loop) via a crafted HTTP header, aka "HTTP.sys Denial of Service Vulnerability."

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities