MyWebServer Search Request Remote Buffer Overflow Vulnerability

Bugtraq ID:	5469
Class:	Boundary Condition Error
CVE:	CVE-2002-1452
Remote:	Yes
Local:	No
Published:	Aug 14 2002 12:00AM
Updated:	Jul 11 2009 03:56PM
Credit:	Discovered by D4rkGr3y <[email protected]>.
Vulnerable:	MyWebServer MyWebServer 1.0.2 - Microsoft Windows 2000 Advanced Server SP2 - Microsoft Windows 2000 Advanced Server SP1 - Microsoft Windows 2000 Advanced Server - Microsoft Windows 2000 Datacenter Server SP2 - Microsoft Windows 2000 Datacenter Server SP1 - Microsoft Windows 2000 Datacenter Server - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 2000 Server SP2 - Microsoft Windows 2000 Server SP1 - Microsoft Windows 2000 Server - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows ME - Microsoft Windows NT Enterprise Server 4.0 SP6a - Microsoft Windows NT Enterprise Server 4.0 SP6 - Microsoft Windows NT Enterprise Server 4.0 SP5 - Microsoft Windows NT Enterprise Server 4.0 SP4 - Microsoft Windows NT Enterprise Server 4.0 SP3 - Microsoft Windows NT Enterprise Server 4.0 SP2 - Microsoft Windows NT Enterprise Server 4.0 SP1 - Microsoft Windows NT Enterprise Server 4.0 - Microsoft Windows NT Server 4.0 SP6a - Microsoft Windows NT Server 4.0 SP6 - Microsoft Windows NT Server 4.0 SP5 - Microsoft Windows NT Server 4.0 SP4 - Microsoft Windows NT Server 4.0 SP3 - Microsoft Windows NT Server 4.0 SP2 - Microsoft Windows NT Server 4.0 SP1 - Microsoft Windows NT Server 4.0 - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0
Not Vulnerable:

MyWebServer Search Request Remote Buffer Overflow Vulnerability

MyWebServer is an application and web server for Microsoft Windows operating systems. MyWebServer includes a number of web based functions, including a search engine.

MyWebServer suffers from a remote buffer overflow vulnerability. If a parameter longer than 990 characters is submitted to the included search engine, this condition will be exploited.

It has been reported possible to execute arbitrary code as the MyWebServer process. Crashing the process may also result in a denial of service condition.

MyWebServer Search Request Remote Buffer Overflow Vulnerability

An exploit has been provided by D4rkGr3y <[email protected]>:

• /data/vulnerabilities/exploits/MWS_exp.pl

MyWebServer Search Request Remote Buffer Overflow Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

MyWebServer Search Request Remote Buffer Overflow Vulnerability

References:

• MyWebServer Homepage (MyWebServer)