NovaStor NovaNET 'DtbClsLogin()' Remote Stack Buffer Overflow Vulnerability

Bugtraq ID:	33954
Class:	Boundary Condition Error
CVE:	CVE-2009-0849
Remote:	Yes
Local:	No
Published:	Mar 02 2009 12:00AM
Updated:	Apr 13 2015 09:11PM
Credit:	AbdulAziz Hariri
Vulnerable:	NovaStor NovaNET 12
Not Vulnerable:

NovaStor NovaNET 'DtbClsLogin()' Remote Stack Buffer Overflow Vulnerability

NovaStor NovaNET is prone to a stack-based buffer-overflow vulnerability because it fails to adequately bounds-check user-supplied data before copying it to an insufficiently sized buffer.

Attackers can exploit this issue to execute arbitrary code within the context of the affected application or cause a denial-of-service condition.

NovaNET 12 is vulnerable; other versions may also be affected.

NovaStor NovaNET 'DtbClsLogin()' Remote Stack Buffer Overflow Vulnerability

The following proof of concept is available. Please note that Symantec has not tested or verified this file.

• /data/vulnerabilities/exploits/33954.c

NovaStor NovaNET 'DtbClsLogin()' Remote Stack Buffer Overflow Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

NovaStor NovaNET 'DtbClsLogin()' Remote Stack Buffer Overflow Vulnerability

References:

• NovaNET 12 Remote Buffer Oveflow (Insight Technologies)
  
• NovaNET Homepage (NovaStor)