iPlanet Webserver .shtml Buffer Overflow Vulnerability

Bugtraq ID:	1848
Class:	Boundary Condition Error
CVE:
Remote:	Yes
Local:	Yes
Published:	Oct 26 2000 12:00AM
Updated:	Oct 26 2000 12:00AM
Credit:	Discovered and posted to Bugtraq by Security Research Team <[email protected]> on Oct 26, 2000.
Vulnerable:	Sun iPlanet Web Server 4.0 - Digital (Compaq) TRU64/DIGITAL UNIX 4.0 d - HP HP-UX 11.0 - IBM AIX 4.3.3 - Linux kernel 2.2.12 - Microsoft Windows NT 4.0 - Sun Solaris 8_sparc - Sun Solaris 2.6
Not Vulnerable:

iPlanet Webserver .shtml Buffer Overflow Vulnerability

iPlanet Webserver is an http server product offered by the Sun-Netscape Alliance.

By sending a specially crafted request comprised of approximately 198 - 240 characters with .shtml (default) file extension, it is possible to cause a buffer overflow and allow the execution of arbitrary code. This is due to the way iPlanet parses .shtml files.

This vulnerability is only known to be exploitable if the server side 'parsing' option is enabled.

Successful exploitation of this vulnerability could lead to a complete compromise of the host.

iPlanet Webserver .shtml Buffer Overflow Vulnerability

Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].

iPlanet Webserver .shtml Buffer Overflow Vulnerability

Solution:
This vulnerability has been addressed in iPlanet Web Server 4.1SP4 and can be downloaded from:

http://www.iplanet.com/downloads/download/detail_161_802.html

iPlanet Webserver .shtml Buffer Overflow Vulnerability

References:

• iPlanet Product Homepage (Sun Netscape Alliance)