MNews Server Response Buffer Overflow Vulnerability
BID:4900
Info
MNews Server Response Buffer Overflow Vulnerability
| Bugtraq ID: | 4900 |
| Class: | Boundary Condition Error |
| CVE: |
CVE-2002-0909 |
| Remote: | Yes |
| Local: | No |
| Published: | May 31 2002 12:00AM |
| Updated: | Jul 11 2009 01:56PM |
| Credit: | Vulnerability discovery credited to zillion <[email protected]>. |
| Vulnerable: |
Matsushita Research MNews 1.2.2 |
| Not Vulnerable: | |
Discussion
MNews Server Response Buffer Overflow Vulnerability
Mnews is a freely available, open source NNTP and mail client. It is designed to handle both Japanese and English character sets, and is available for the Unix and Linux operating systems.
Under some circumstances, it may be possible to exploit a buffer overflow in mnews. When a server sends a 200 response to a client, it may be possible for the server to include enough data in the response to trigger a buffer overflow. This overflow could result in the overwriting of stack memory, and the potential execution of attacker supplied instructions.
Mnews is a freely available, open source NNTP and mail client. It is designed to handle both Japanese and English character sets, and is available for the Unix and Linux operating systems.
Under some circumstances, it may be possible to exploit a buffer overflow in mnews. When a server sends a 200 response to a client, it may be possible for the server to include enough data in the response to trigger a buffer overflow. This overflow could result in the overwriting of stack memory, and the potential execution of attacker supplied instructions.