W3C Amaya HTML 'input' Tag Parameter Buffer Overflow Vulnerability

Bugtraq ID:	33046
Class:	Boundary Condition Error
CVE:	CVE-2009-0323
Remote:	Yes
Local:	No
Published:	Jan 28 2009 12:00AM
Updated:	Feb 11 2009 07:58PM
Credit:	Dan Crowley and Alfredo Ortega from Core Security Technologies
Vulnerable:	W3C Amaya 10.0.1 W3C Amaya 9.5 W3C Amaya 9.4 W3C Amaya 11.0 W3C Amaya 10.1
Not Vulnerable:	W3C Amaya 11.1

W3C Amaya HTML 'input' Tag Parameter Buffer Overflow Vulnerability

W3C Amaya is prone to a remote buffer-overflow vulnerability because the application fails to perform adequate boundary checks on user-supplied input.

Attackers may leverage this issue to execute arbitrary code in the context of the application. Failed attacks will cause denial-of-service conditions.

Amaya 11.0 and prior are vulnerable.

W3C Amaya HTML 'input' Tag Parameter Buffer Overflow Vulnerability

Core Security Technologies has developed a working commercial exploit for its CORE IMPACT product. This exploit is not otherwise publicly available or known to be circulating in the wild.

The following proof of concept is available:

• /data/vulnerabilities/exploits/33046.html

W3C Amaya HTML 'input' Tag Parameter Buffer Overflow Vulnerability

Solution:
Amaya 11.1 addresses this issue. Please see the references for more information.

W3C Amaya HTML 'input' Tag Parameter Buffer Overflow Vulnerability

References:

• Amaya Homepage (W3C)
  
• CORE-2008-1211: Amaya web editor XML and HTML parser vulnerabilities (Core Security Technologies Advisories )
  
• Amaya web editor XML and HTML parser vulnerabilities (Core Security Technologies)