4D Web Server Buffer Overflow in Processing Basic HTTP Authentication Lets Remote Users Crash the Server and May Allow Arbitrary Code to Be Executed
SecurityTracker Alert ID: 1004211|
SecurityTracker URL: http://securitytracker.com/id/1004211
(Links to External Site)
Date: May 2 2002
Denial of service via network, Execution of arbitrary code via network, User access via network|
Fix Available: Yes Vendor Confirmed: Yes Exploit Included: Yes |
A buffer overflow vulnerability has been reported in the 4D web server. A remote user can cause the web service to crash and may be able to execute arbitrary code on the server.|
iXsecurity warned that a remote user can submit a basic authentication request with specially crafted contents for the 'username' or the 'password' field to trigger the overflow.
It is reported that the server performs some checks to ensure that only certain permitted characters are submitted but fails to check the length of the strings. A remote user can trigger the overflow and cause the EIP register to be overwritten, either crashing the server or potentially executing arbitrary code on the server.
A remote user can crash the web server and may be able to execute arbitrary code on the server with the privileges of the web server.|
The vendor has reportedly issued a fix or will be issuing a fix shortly. According to the report, 4D has assigned this issue Bug Number: ACI0021102. The upgrade version may be 4D 6.8.1. Contact the vendor for additional information.|
The latest versions are available at:
Vendor URL: www.4d.com/ (Links to External Site)
|Underlying OS: Windows (Any)|
Source Message Contents
iXsecurity Security Vulnerability Report
Problem: The 4D webserver has a buffer overflow condition.
Threat: An attacker could make the webserver crash and
possibly execute arbitrary code.
Affected Software: 4D Webserver version 6.7.3 verified.
Platform: Windows verified.
Solution: Update to the version mentioned below.
An attacker could overflow the username or password field in a basic
authentication resulting in EIP overwrite and possible arbitrary code
execution. There are a few checks of the buffer, including a check to
sure only "valid" characters are sent. If "invalid" characters are found
the copy is terminated. Ironicaly there is no bounds check. Because of
various checks, it is a bit more complicated to exploit, since it
the code one can include in the buffer.
The solution for Bug Number: ACI0021102 is to upgrade to the latest
version, which will be 4D 6.7.4 or 4D 6.8.1.
4D was contacted 20020405.
This vulnerability was found and researched by