Savant Web Server Buffer Overflow Vulnerability

Bugtraq ID:	1453
Class:	Boundary Condition Error
CVE:
Remote:	Yes
Local:	Yes
Published:	Jul 08 2000 12:00AM
Updated:	Jul 08 2000 12:00AM
Credit:	Discovered by and posted to bugtraq on July 8, 2000 by Andrew Lewis <wizdumb@ unix.za.net>.
Vulnerable:	Michael Lamont Savant WebServer 3.0 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows 98SE - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0 Michael Lamont Savant WebServer 2.1 - Microsoft Windows 2000 Professional - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows 98SE - Microsoft Windows NT 4.0
Not Vulnerable:

Savant Web Server Buffer Overflow Vulnerability

A buffer overflow exists in the Savant Web Server. It is possible to exploit this overflow by sending an unusually long GET request to the server.

Savant Web Server Buffer Overflow Vulnerability

Andrew Lewis <[email protected]> has provided the following exploit:

• /data/vulnerabilities/exploits/savant.java

Savant Web Server Buffer Overflow Vulnerability

Solution:
Currently the SecurityFocus staff are not aware of any vendor supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].