Vignette StoryServer Sensitive Stack Memory Information Disclosure Vulnerability

Bugtraq ID:	7296
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2002-0385
Remote:	Yes
Local:	No
Published:	Apr 07 2003 12:00AM
Updated:	Jul 11 2009 09:06PM
Credit:	Discovery of this vulnerability has been credited to @stake.
Vulnerable:	Vignette Vignette V/5 Vignette StoryServer 4.1
Not Vulnerable:

Vignette StoryServer Sensitive Stack Memory Information Disclosure Vulnerability

It has been reported that Vignette StoryServer, under some circumstances may reveal stack memory content.

If a specially crafted request is made for a page that accepts user-supplied data an error state may be triggered. If the attack is successful a dump of the current stack contents will be returned to the attackers browser within an error message.

The information gathered in this way may be used to mount further attacks against the system.

Vignette StoryServer Sensitive Stack Memory Information Disclosure Vulnerability

The following proof of concept has been supplied:

https://www.example.com/securelogin/1,2345,A,00.html?Errmessage="x214>x214

Vignette StoryServer Sensitive Stack Memory Information Disclosure Vulnerability

Solution:
The vendor has released a patch to address this issue. Customers are advised to contact Vignette technical support regarding security concerns and to update if required.

Vignette StoryServer Sensitive Stack Memory Information Disclosure Vulnerability

References:

• Vignette Homepage (VIGNETTE)
  
• Vignette Story Server sensitive information disclosure (@stake)