Macromedia JRun URL Parsing Remote Buffer Overflow Vulnerability

Bugtraq ID:	16026
Class:	Boundary Condition Error
CVE:
Remote:	Yes
Local:	No
Published:	Dec 16 2005 12:00AM
Updated:	Dec 16 2005 12:00AM
Credit:	An anonymous researcher discovered this issue.
Vulnerable:	Macromedia JRun 4.0 SP1a Macromedia JRun 4.0 SP1 Macromedia JRun 4.0 build 61650 Macromedia JRun 4.0 - Microsoft IIS 5.1 - Microsoft IIS 5.0 - Microsoft IIS 4.0
Not Vulnerable:

Macromedia JRun URL Parsing Remote Buffer Overflow Vulnerability

Macromedia JRun is prone to a remote buffer overflow vulnerability.

An attacker can exploit this issue to crash the server resulting in a denial of service to legitimate users. Arbitrary code execution may also be possible, which may facilitate a complete compromise of the underlying system.

This issue was originally reported in BID 15905 (Macromedia JRun Multiple Vulnerabilities). Due to the availability of more information, it is being assigned a new BID.

Macromedia JRun URL Parsing Remote Buffer Overflow Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Macromedia JRun URL Parsing Remote Buffer Overflow Vulnerability

Solution:
The vendor has released JRun 4.0 Updater 6 to address this issue. The fix may be obtained from the Macromedia JRun Support Center. Please see the attached vendor advisory for further details.

Macromedia JRun URL Parsing Remote Buffer Overflow Vulnerability

References:

• Macromedia JRun 4 Web Server URL Parsing Buffer Overflow Vulnerability (iDEFENSE)
  
• Macromedia JRun Support Center (Macromedia)
  
• MPSB05-13 Cumulative Security Updater for JRun 4.0 server (Macromedia)