Multiple Oops Proxy Server Buffer Overflow Vulnerabilities
BID:2099
Info
Multiple Oops Proxy Server Buffer Overflow Vulnerabilities
| Bugtraq ID: | 2099 |
| Class: | Boundary Condition Error |
| CVE: |
CVE-2001-0028 CVE-2001-0029 |
| Remote: | Yes |
| Local: | No |
| Published: | Dec 11 2000 12:00AM |
| Updated: | Jul 11 2009 03:56AM |
| Credit: | The heap overflow vulnerability was announced by |CyRaX| <[email protected]> via Bugtraq on December 11, 2000. The stack based overflow was discovered by Dmitry Galyant <[email protected]> and announced via Bugtraq on December 12, 2000. |
| Vulnerable: |
Igor Khasilev Oops Proxy Server 1.4.22 |
| Not Vulnerable: | |
Discussion
Multiple Oops Proxy Server Buffer Overflow Vulnerabilities
Oops is a freely available proxy server package, written by Igor Khasilev. A problem exists in the package which could allow for the arbitrary execution of code.
Multiple buffer overflows exist in this product. In one instance, it is possible to make a request with numerous quotation marks (") in the request, which are later translated to the html tag "&quot;". The translation of this character makes it possible to overflow and potentially execute code on the stack. This makes it possible for a malicious user to execute code with the privileges of the user the proxy server is operating as.
The secondary problem involves a buffer overflow in the DNS resolution code. It is possible to create a stack based overflow by forcing the proxy to attempt to resolve a long host/domain name. This makes it possible to overwrite variables on the stack, and potentially execute arbitrary code. It is possible for a malicious user to exploit this problem and execute commands with the privileges inherited by the proxy server process.
Oops is a freely available proxy server package, written by Igor Khasilev. A problem exists in the package which could allow for the arbitrary execution of code.
Multiple buffer overflows exist in this product. In one instance, it is possible to make a request with numerous quotation marks (") in the request, which are later translated to the html tag "&quot;". The translation of this character makes it possible to overflow and potentially execute code on the stack. This makes it possible for a malicious user to execute code with the privileges of the user the proxy server is operating as.
The secondary problem involves a buffer overflow in the DNS resolution code. It is possible to create a stack based overflow by forcing the proxy to attempt to resolve a long host/domain name. This makes it possible to overwrite variables on the stack, and potentially execute arbitrary code. It is possible for a malicious user to exploit this problem and execute commands with the privileges inherited by the proxy server process.
Exploit / POC
Multiple Oops Proxy Server Buffer Overflow Vulnerabilities
PKCoops-ex.c was contributed by |CyRaX| <[email protected]> . oopz.c was contributed by Dmitry Galyant <[email protected]> .
PKCoops-ex.c was contributed by |CyRaX| <[email protected]> . oopz.c was contributed by Dmitry Galyant <[email protected]> .
Solution / Fix
Multiple Oops Proxy Server Buffer Overflow Vulnerabilities
Solution:
Currently the SecurityFocus staff are not aware of any vendor supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
Igor Khasilev Oops Proxy Server 1.4.22
Solution:
Currently the SecurityFocus staff are not aware of any vendor supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
Igor Khasilev Oops Proxy Server 1.4.22
-
FreeBSD 3.5.1 i386 oops-1.5.2.tgz
ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-3-stable/www/oop s-1.5.2.tgz -
FreeBSD 4.2 alpha oops-1.5.2.tgz
ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/alpha/packages-4-stable/www/oo ps-1.5.2.tgz -
FreeBSD 4.2 i386 oops-1.5.2.tgz
ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-4-stable/www/oop s-1.5.2.tgz -
FreeBSD 5.0 alpha oops-1.5.2.tgz
ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/alpha/packages-5-current/www/o ops-1.5.2.tgz -
FreeBSD 5.0 i386 oops-1.5.2.tgz
ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-5-current/www/oo ps-1.5.2.tgz
References
Multiple Oops Proxy Server Buffer Overflow Vulnerabilities
References:
References: