Cruiseworks Cws.exe Doc Buffer Overflow Vulnerability

Bugtraq ID:	20699
Class:	Boundary Condition Error
CVE:
Remote:	Yes
Local:	No
Published:	Oct 24 2006 12:00AM
Updated:	Oct 24 2006 11:33PM
Credit:	Tan Chew Keong discovered this vulnerability.
Vulnerable:	Cruiseworks Cruiseworks 1.09.d Cruiseworks Cruiseworks 1.09.c
Not Vulnerable:	Cruiseworks Cruiseworks 1.09.e

Cruiseworks Cws.exe Doc Buffer Overflow Vulnerability

Cruiseworks is prone to a remote buffer-overflow vulnerability.

Specifically, the application fails to validate input passed to the 'doc' parameter of the '/scripts/cruise/cms.exe' application.

Cruiseworks 1.09c and 1.09d are reported vulnerable; other versions may be affected as well.

Cruiseworks Cws.exe Doc Buffer Overflow Vulnerability

A proof of concept is available.

• /data/vulnerabilities/exploits/cruiseworks_buffer_overflow.txt

Cruiseworks Cws.exe Doc Buffer Overflow Vulnerability

Solution:
An updated version that addresses this issue is available. Please see the vendor references for more information.


Cruiseworks Cruiseworks 1.09.d

• Cruiseworks Cruiseworks 1.09e
  http://www.kynos.co.jp/cruise/cws/home.shtml

Cruiseworks Cws.exe Doc Buffer Overflow Vulnerability

References:

• CruiseWorks Directory Traversal and Buffer Overflow Vulnerabilities (Tan Chew Keong)
  
• Cruiseworks Homepage (Cruiseworks)
  
• CruiseWorks ???????????????? (JP CERT)