PXE Server Remote Buffer Overrun Vulnerability

Bugtraq ID:	7129
Class:	Boundary Condition Error
CVE:
Remote:	Yes
Local:	No
Published:	Mar 17 2003 12:00AM
Updated:	Mar 17 2003 12:00AM
Credit:	Discovery credited to n-arrow@efnet.
Vulnerable:	Redhat PXE Server 2.0 Beta 1
Not Vulnerable:

PXE Server Remote Buffer Overrun Vulnerability

A vulnerability has been discovered in PXE which is included with Red Hat Linux. Specifically, it is possible for a remote attacker to overrun a buffer by passing excessive data to the service. This may result in the corruption of sensitive process memory, and as such may allow an attacker to execute arbitrary commands.

This issue has been reported to exist in PXE 2.0 Beta-1 on Red Hat Linux. Other versions may also be affected by this vulnerability.

PXE Server Remote Buffer Overrun Vulnerability

An exploit has been released by CrZ <[email protected]> and LByte <lbyte.void.ru>.

• /data/vulnerabilities/exploits/85pxe.c

PXE Server Remote Buffer Overrun Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

PXE Server Remote Buffer Overrun Vulnerability

References: