Omron WorldView Wnn Asian Language Server Remote Buffer Overflow Vulnerability
BID:1603
Info
Omron WorldView Wnn Asian Language Server Remote Buffer Overflow Vulnerability
| Bugtraq ID: | 1603 |
| Class: | Boundary Condition Error |
| CVE: |
CVE-2000-0704 |
| Remote: | Yes |
| Local: | No |
| Published: | Mar 08 2000 12:00AM |
| Updated: | Jul 11 2009 02:56AM |
| Credit: | This vulnerability was discovered by UNYUN <[email protected]> |
| Vulnerable: |
Wnn Wnn4 4.2 -8 Wnn Wnn4 4.2 -5TL Wnn Wnn4 4.2 -2TL Omron WorldView 6.5 FreeWnn FreeWnn 1.1.1 -aXXX FreeWnn FreeWnn 1.1 FreeWnn FreeWnn 1.0 |
| Not Vulnerable: | |
Discussion
Omron WorldView Wnn Asian Language Server Remote Buffer Overflow Vulnerability
A remote buffer overflow exists in the Asian language servers portion of a number of different implementations of Wnn. It has been reported that only systems that have WorldView Japanese, Korean, and Chinese installed are vulnerable to this issue. Wnn is a Kana-Kanji translation system, most commonly used for foreign language support in Unix systems.
An overflow exists when the server receives a long string with a Wnn command, such as JS_OPEN, JS_MKDIR or JS_FILE_INFO included. By creating a buffer containing machine executable code, it is possible to cause a remote system running the jserver daemon to execute arbitrary commands as the user the daemon is running as. This is frequently root.
A remote buffer overflow exists in the Asian language servers portion of a number of different implementations of Wnn. It has been reported that only systems that have WorldView Japanese, Korean, and Chinese installed are vulnerable to this issue. Wnn is a Kana-Kanji translation system, most commonly used for foreign language support in Unix systems.
An overflow exists when the server receives a long string with a Wnn command, such as JS_OPEN, JS_MKDIR or JS_FILE_INFO included. By creating a buffer containing machine executable code, it is possible to cause a remote system running the jserver daemon to execute arbitrary commands as the user the daemon is running as. This is frequently root.
Exploit / POC
Omron WorldView Wnn Asian Language Server Remote Buffer Overflow Vulnerability
The following exploit was provided by UNYUN ([email protected]).
The following exploit was provided by UNYUN ([email protected]).
Solution / Fix
References
Omron WorldView Wnn Asian Language Server Remote Buffer Overflow Vulnerability
References:
References:
- freewnn (FreeWnn.org)
- security problem of jserver (freewnn mailing list)
- SGI Support (Silicon Graphics Inc.)
- TurboLinux Support (TurboLinux)
- Wnn4.2/FreeWnn1.10/FreeWnn1.1.1a016-jserver remote overflow exploit (shadow penguin security)