Appfluent Technology Database IDS APPFLUENT_HOME Variable Buffer Overflow Vulnerability

Bugtraq ID:	15755
Class:	Boundary Condition Error
CVE:	CVE-2005-4076
Remote:	No
Local:	Yes
Published:	Dec 07 2005 12:00AM
Updated:	Dec 07 2005 12:00AM
Credit:	Discovered by c0ntex <[email protected]>.
Vulnerable:	Appfluent Technology Database IDS 2.0
Not Vulnerable:	Appfluent Technology Database IDS 2.1 .0.103

Appfluent Technology Database IDS APPFLUENT_HOME Variable Buffer Overflow Vulnerability

Appfluent Technology Database IDS is prone to a local buffer overflow vulnerability.

This issue presents itself when the affected application handles a malformed value passed through the APPFLUENT_HOME environment variable.

A successful attack can allow an attacker to execute arbitrary code on the affected computer. A complete compromise may be possible as well.

Appfluent Technology Database IDS 2.0 is reported to be vulnerable. Other versions may be affected as well.

Appfluent Technology Database IDS APPFLUENT_HOME Variable Buffer Overflow Vulnerability

The following exploit is available:

• /data/vulnerabilities/exploits/appfluent_db_ids_exp.c

Appfluent Technology Database IDS APPFLUENT_HOME Variable Buffer Overflow Vulnerability

Solution:
Reports indicate that this issue has been addressed in Appfluent Database IDS 2.1.0.103. This could not be confirmed by Symantec.

Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Appfluent Technology Database IDS APPFLUENT_HOME Variable Buffer Overflow Vulnerability

References:

• Appfluent Batabase IDS Local Root (c0ntex)
  
• Appfluent Database IDS Environment Variable Overflow (c0ntex)
  
• Home Page (Appfluent Technology)