Motion 'read_client()' Off-By-One Buffer Overflow Vulnerability
BID:29636
Info
Motion 'read_client()' Off-By-One Buffer Overflow Vulnerability
| Bugtraq ID: | 29636 |
| Class: | Boundary Condition Error |
| CVE: |
CVE-2008-2654 |
| Remote: | Yes |
| Local: | No |
| Published: | Jun 10 2008 12:00AM |
| Updated: | Jul 02 2008 11:20PM |
| Credit: | Nico Golde |
| Vulnerable: |
Kenneth Jahn Lavrsen Motion 3.2.10 Kenneth Jahn Lavrsen Motion 3.2.9 Gentoo Linux |
| Not Vulnerable: |
Kenneth Jahn Lavrsen Motion 3.2.10 .1 |
Discussion
Motion 'read_client()' Off-By-One Buffer Overflow Vulnerability
Motion is prone to an off-by-one buffer-overflow vulnerability because the application fails to perform adequate boundary checks on user-supplied data.
An attacker can exploit this issue to execute arbitrary code within the context of the affected application. Successfully exploiting this issue may compromise the affected application and possibly the underlying computer. Failed exploit attempts will result in a denial-of-service condition.
Motion 3.2.10 and prior versions are vulnerable.
Motion is prone to an off-by-one buffer-overflow vulnerability because the application fails to perform adequate boundary checks on user-supplied data.
An attacker can exploit this issue to execute arbitrary code within the context of the affected application. Successfully exploiting this issue may compromise the affected application and possibly the underlying computer. Failed exploit attempts will result in a denial-of-service condition.
Motion 3.2.10 and prior versions are vulnerable.
Exploit / POC
Motion 'read_client()' Off-By-One Buffer Overflow Vulnerability
Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution / Fix
Motion 'read_client()' Off-By-One Buffer Overflow Vulnerability
Solution:
The vendor released Motion 3.2.10.1 to address this issue. Please see the references for more information.
Kenneth Jahn Lavrsen Motion 3.2.10
Kenneth Jahn Lavrsen Motion 3.2.9
Solution:
The vendor released Motion 3.2.10.1 to address this issue. Please see the references for more information.
Kenneth Jahn Lavrsen Motion 3.2.10
-
Kenneth Jahn Lavrsen motion-3.2.10.1.tar.gz
http://downloads.sourceforge.net/motion/motion-3.2.10.1.tar.gz -
Kenneth Jahn Lavrsen webhttpd10-security.dif
http://www.lavrsen.dk/twiki/pub/Motion/ReleaseNoteMotion3x2x10/webhttp d-security.diff
Kenneth Jahn Lavrsen Motion 3.2.9
-
Kenneth Jahn Lavrsen motion-3.2.10.1.tar.gz
http://downloads.sourceforge.net/motion/motion-3.2.10.1.tar.gz -
Kenneth Jahn Lavrsen webhttpd-security-video2-backport.diff
http://www.lavrsen.dk/twiki/pub/Motion/ReleaseNoteMotion3x2x9/webhttpd -security-video2-backport.diff
References
Motion 'read_client()' Off-By-One Buffer Overflow Vulnerability
References:
References:
- [motion] off-by-one in webhttpd.c (Nico Golde)
- Vendor Homepage (Kenneth Jahn Lavrsen)
- Motion "read_client()" HTTP Request Buffer Overflow (Secunia Research)
- Motion Release 3.2.10.1 - Release Notes (Kenneth Jahn Lavrsen)