YOPS (Your Own Personal [WEB] Server) Remote Buffer Overflow Vulnerability

Bugtraq ID:	43156
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Sep 10 2010 12:00AM
Updated:	Nov 25 2010 05:36PM
Credit:	Rodrigo Escobar aka ipax
Vulnerable:	YOPS YOPS (Your Own Personal [WEB] Server) 2009-11-30
Not Vulnerable:	YOPS YOPS (Your Own Personal [WEB] Server) 2010-11-25

YOPS (Your Own Personal [WEB] Server) Remote Buffer Overflow Vulnerability

YOPS (Your Own Personal [WEB] Server) is prone to a remote buffer-overflow vulnerability because it fails to perform adequate checks on user-supplied input.

Successfully exploiting this issue may allow remote attackers to execute arbitrary commands in the context of the application. Failed attacks will cause denial-of-service conditions.

YOPS (Your Own Personal [WEB] Server) 2009-11-30 is vulnerable; other versions may also be affected.

YOPS (Your Own Personal [WEB] Server) Remote Buffer Overflow Vulnerability

The following exploit code is available:

• /data/vulnerabilities/exploits/43156.py

YOPS (Your Own Personal [WEB] Server) Remote Buffer Overflow Vulnerability

Solution:
The vendor released a patch. Please see the references for more information.


YOPS YOPS (Your Own Personal [WEB] Server) 2009-11-30

• YOPS yops-2010-11-25.tar.bz2
  http://zed.karelia.ru/yops/yops-2010-11-25.tar.bz2

YOPS (Your Own Personal [WEB] Server) Remote Buffer Overflow Vulnerability

References:

• [DCA-00015] YOPS Web Server Remote Command Execution (Rodrigo Escobar )
  
• YOPS Homepage (zed.karelia.ru)
  
• YOPS Project Page (SourceForge)