MyWeb HTTP Server GET Request Buffer Overflow Vulnerability

Bugtraq ID:	10303
Class:	Boundary Condition Error
CVE:
Remote:	Yes
Local:	No
Published:	May 07 2004 12:00AM
Updated:	May 07 2004 12:00AM
Credit:	Discovery of this vulnerability has been credited to "badpack3t" <[email protected]>.
Vulnerable:	xuebrothers MyWeb 3.3
Not Vulnerable:

MyWeb HTTP Server GET Request Buffer Overflow Vulnerability

A vulnerability has been reported for MyWeb HTTP server. The problem occurs due to insufficient bounds checking when handling GET requests.

As a result, an attacker may be capable of corrupting sensitive data such as a return address, and thereby effectively control the execution flow of the program. This would ultimately allow for the execution of arbitrary code. Immediate consequences of exploitation of this issue may result in denial of service.

MyWeb HTTP Server GET Request Buffer Overflow Vulnerability

The following proof of concept exploit, which will result in a denial of service condition, has been supplied by badpack3t <[email protected]>:

• /data/vulnerabilities/exploits/sp-myweb3.3.c

MyWeb HTTP Server GET Request Buffer Overflow Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

MyWeb HTTP Server GET Request Buffer Overflow Vulnerability

References:

• MyWeb Homepage (xuebrothers)
  
• SP Research Labs Advisory x11 ("badpack3t" )