Surfboard httpd Buffer Overflow May Allow a Remote User to Execute Arbitrary Code
|
|
SecurityTracker Alert ID: 1008549 |
|
SecurityTracker URL: http://securitytracker.com/id/1008549
|
|
CVE Reference:
GENERIC-MAP-NOMATCH
(Links to External Site)
|
Updated: Dec 26 2003
|
Original Entry Date: Dec 26 2003
|
Impact:
Denial of service via network, Execution of arbitrary code via network
|
Exploit Included: Yes
|
Version(s): 1.1.9
|
Description:
d3ck4 reported a buffer overflow vulnerability in the Surfboard httpd web server. A remote user may be able to execute arbitrary code (but that was not confirmed in the report).
It is reported that a remote user can request a specially crafted URL with more than 1024 characters to trigger a buffer overflow, overwriting the EDI register.
A demonstration exploit HTTP GET request is provided:
GET /AAAAAAAAAAAA..x1024++ HTTP/1.1\r\n\r\n
|
Impact:
A remote user may be able to cause the target service to crash. A remote user may be able to execute arbitrary code on the target system. [Editor's note: The report did not confirm the specific impact of this buffer overflow.]
|
Solution:
No solution was available at the time of this entry.
|
Vendor URL: surfd.sourceforge.net/ (Links to External Site)
|
Cause:
Boundary error
|
Underlying OS: Linux (Any), UNIX (Any)
|
|
Message History:
None.
|
Source Message Contents
|
Subject: surfboard 1.1.9 and maybe all version contain remote buffer overflow
|
#######################################################################
(c) d3ck4
Application: Surfboard webserver
http://surfd.sourceforge.net
Versions: All
Platforms: *nix
Bugs: Boundary Condition Error
Risk: medium/high
Date: 25 Dec 2003
Author: d3ck4
e-mail: decka_trash@yahoo.com
#######################################################################
1) Introduction
2) Bug
3) Proof of Concept
#######################################################################
===============
1) Introduction
===============
>From the website:
"Surfboard is a trivial web server, written by
Meredydd Luff."
#######################################################################
=======
2) Bugs
=======
When a long crafted index file with more than 1024
characters requested will cause an overflow and
overwrite the EDI register. Im not sure this may allow
an remote attacker to executing an arbitary code and
gain control on the target system with default
uid=99(nobody) gid=99(nobody) privileges.
#######################################################################
================
Proof of concept
================
Telnet or netcat to the target surfboard http server
and port specified in the system config file and
request:
GET /AAAAAAAAAAAA..x1024++ HTTP/1.1\r\n\r\n
This will cause EDI register overwrite with 0x41414141
which stand for 'A'.
#######################################################################
__________________________________
Do you Yahoo!?
Free Pop-Up Blocker - Get it now
http://companion.yahoo.com/
|
|
