Netscript Remote Code Execution Vulnerability
BID:3676
Info
Netscript Remote Code Execution Vulnerability
| Bugtraq ID: | 3676 |
| Class: | Boundary Condition Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Nov 29 2001 12:00AM |
| Updated: | Nov 29 2001 12:00AM |
| Credit: | The origin of this vulnerability is unknown. |
| Vulnerable: |
v9 netscript 1.6.4 v9 netscript 1.6.3 v9 netscript 1.6.2 v9 netscript 1.6.1 v9 netscript 1.6 |
| Not Vulnerable: |
v9 netscript 1.6.5 |
Discussion
Netscript Remote Code Execution Vulnerability
Netscript is a program designed to allow simple, fast TCP socket scripting. Based on a word substitution ruleset, simple socket based applications may be rapidly developed, and common tasks automated.
The flags -H and -D may be used to display information in hexadecimal or decimal notation, instead of by character. When the remote system sends high valued data, such as 0xFF, memory may be corrupted in a manner that may allow for an attacker to take control over process execution. This situation is dependent on the specific ruleset being used by netscript, which may make it difficult to exploit.
Earlier versions of netscript may also be vulnerable.
Netscript is a program designed to allow simple, fast TCP socket scripting. Based on a word substitution ruleset, simple socket based applications may be rapidly developed, and common tasks automated.
The flags -H and -D may be used to display information in hexadecimal or decimal notation, instead of by character. When the remote system sends high valued data, such as 0xFF, memory may be corrupted in a manner that may allow for an attacker to take control over process execution. This situation is dependent on the specific ruleset being used by netscript, which may make it difficult to exploit.
Earlier versions of netscript may also be vulnerable.
Exploit / POC
Netscript Remote Code Execution Vulnerability
Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution / Fix
Netscript Remote Code Execution Vulnerability
Solution:
This vulnerability is fixed in version 1.6.5 of netscript.
Solution:
This vulnerability is fixed in version 1.6.5 of netscript.