|
|
|
|
| |
| The TelCondex SimpleWebserver is vulnerable to a remote executable buffer overflow, due to missing length check on the referer-variable of the HTTP-header. |
| |
Credit:
The information has been provided by Oliver Karow.
|
| |
Vulnerable systems:
* TelCondex SimpleWebserver version 2.12.30210 Build 3285
Immune systems:
* TelCondex SimpleWebserver version 2.13
It is possible to overwrite the stack, and therefore to execute arbitrary code on the system, by sending the HTTP server a specially crafted HTTP GET request.
Example:
netcat webserver 80
GET /index.htm HTTP/1.0\r\n
Referer: 700 x [A]\r\n\r\n
The web server crashes whenever 700 bytes or more are sent. A buffer of 704 bytes will overwrite the return address on the stack.
Vendor status:
The vendor was informed about the vulnerability on Mon. 27.10.03, and responded on Tue. 28.10.03 with a fixed version.
The new (fixed) version (2.13) is available at:
http://www.yourinfosystem.de/download/TcSimpleWebServer2000Setup.exe.
|
|
|
|
|
|
|
