OmniHTTPD Buffer Overflow Vulnerability

Bugtraq ID:	739
Class:	Boundary Condition Error
CVE:
Remote:	Yes
Local:	No
Published:	Oct 22 1999 12:00AM
Updated:	Oct 22 1999 12:00AM
Credit:	Posted to BugTraq by UNYUN <[email protected]> on Oct 22, 1999.
Vulnerable:	Omnicron OmniHTTPD 2.4 Pro Omnicron OmniHTTPD 1.1
Not Vulnerable:

OmniHTTPD Buffer Overflow Vulnerability

There is a remotely exploitable buffer overflow vulnerability in the CGI program "imagemap", which is distributed with Omnicron's OmniHTTPD. During operations made on arguments passed to the program, a lack of bounds checking on a strcpy() call can allow for arbitrary code to be executed on the machine running the server.

OmniHTTPD Buffer Overflow Vulnerability

x

• /data/vulnerabilities/exploits/omnihttpd.c

OmniHTTPD Buffer Overflow Vulnerability

Solution:
Since source code for the imagemap program is supplied, UNYUN of Shadow Penguin Security suggests that checking for oversized arguments be added to the code:

void main(int argc, char **argv)
{
----------- omit ----------
char OutString[100];
----------- omit ----------
if(argc >= 2) {
//
// extract x & y from passed values
//
strcpy(OutString, argv[1]);
~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Buffer overflow caused by this strcpy().
This overflow can be avoided if you put the following code before
strcpy().

if (strlen(argv[1])>99) exit

There are no known vendor provided solutions to this problem.

OmniHTTPD Buffer Overflow Vulnerability

References:

• Omnicron Homepage (Omnicron Technologies Corporation)