HTTP Fetcher Library Multiple Buffer Overflow Vulnerabilities

Bugtraq ID:	6531
Class:	Boundary Condition Error
CVE:
Remote:	Yes
Local:	No
Published:	Jan 06 2003 12:00AM
Updated:	Jan 06 2003 12:00AM
Credit:	The discovery of this vulnerability has been credited to "dong-h0un yoU" <[email protected]>.
Vulnerable:	HTTP Fetcher HTTP Fetcher Library 1.0.1 + Gentoo Linux 1.4 _rc1 + Gentoo Linux 1.2
Not Vulnerable:

HTTP Fetcher Library Multiple Buffer Overflow Vulnerabilities

Multiple vulnerabilities have been discovered in the HTTP Fetcher library. The issues occur when the http_fetch() function is used to copy various HTTP data. By supplying excessive data in various user-supplied parameters it is possible to trigger several overflow conditions.

Successful exploitation of one of these vulnerabilities may allow an attacker to cease control of an application linked to the library. By overwriting the function's instruction pointer it may be possible to execute arbitrary commands.

The exploitability of this issue may be an issue only if the client application were accessible remotely through a proxy server. For instance, a server which allowed a client to make GET requests from other servers.

HTTP Fetcher Library Multiple Buffer Overflow Vulnerabilities

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

HTTP Fetcher Library Multiple Buffer Overflow Vulnerabilities

Solution:
Gentoo Linux has released an advisory. Users who have installed net-www/http-fetcher-1.0.1 or earlier are advised to update their systems by issuing the following commands:

emerge rsync
emerge http-fetcher
emerge clean

HTTP Fetcher Library Multiple Buffer Overflow Vulnerabilities

References:

• [INetCop Security Advisory] Buffer Overflow vulnerability in HTTP ("dong-h0un yoU" )