MiniWeb Directory Traversal and Buffer Overflow Vulnerabilities

Bugtraq ID:	27319
Class:	Unknown
CVE:	CVE-2008-0338 CVE-2008-0337
Remote:	Yes
Local:	No
Published:	Jan 16 2008 12:00AM
Updated:	Jul 05 2016 10:00PM
Credit:	Hamid Ebadi discovered these issues.
Vulnerable:	Stanley Huang MiniWeb 0.8.19
Not Vulnerable:

MiniWeb Directory Traversal and Buffer Overflow Vulnerabilities

MiniWeb is prone to a directory-traversal vulnerability and a heap-based buffer-overflow vulnerability.

An attacker can exploit this issue to gain access to files outside the webroot, execute arbitrary code within the context of the affected application, or crash the application.

This issue affects MiniWeb 0.8.19; other versions may also be affected.

MiniWeb Directory Traversal and Buffer Overflow Vulnerabilities

Exploit code and proof-of-concept examples are available:

http://www.example.com/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/boot.ini

GET /AAAA...[3600 - 4000]...AAAA/ HTTP/1.0

MiniWeb Directory Traversal and Buffer Overflow Vulnerabilities

Solution:
Currently we are not aware of any vendor-supplied patches for these issues. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

MiniWeb Directory Traversal and Buffer Overflow Vulnerabilities

References:

• MiniWeb Homepage (MiniWeb)