Vignette Memory Disclosure Vulnerability
BID:7684
Info
Vignette Memory Disclosure Vulnerability
| Bugtraq ID: | 7684 |
| Class: | Failure to Handle Exceptional Conditions |
| CVE: |
CVE-2003-0400 |
| Remote: | Yes |
| Local: | No |
| Published: | May 26 2003 12:00AM |
| Updated: | Jul 11 2009 10:06PM |
| Credit: | Discovery of this issue is credited to S21SEC <[email protected]>. |
| Vulnerable: |
Vignette Vignette V/5 Vignette V6 Content Suite Vignette StoryServer 5.0 Vignette StoryServer 4.2 Vignette StoryServer 4.1 Vignette StoryServer 4.0 Vignette Content Suite V7 Redhat kernel-2.2.12-20.i686.rpm V6 |
| Not Vulnerable: | |
Discussion
Vignette Memory Disclosure Vulnerability
Vignette is prone to an issue which may expose the contents of memory to remote attackers. This condition is due to a flaw in how StoryServer calculates the size of certain characters in URI variables, which may cause data from adjacent memory to be returned to the remote attacker in the response.
This issue was reported for Vignette on IBM AIX. Other platforms may also be affected, though this has not been confirmed. The issue affects some of the default templates provided with Vignette.
** The vendor has stated that this issue is the same issue reported in BID 7296. This BID will be subsequently retired.
Vignette is prone to an issue which may expose the contents of memory to remote attackers. This condition is due to a flaw in how StoryServer calculates the size of certain characters in URI variables, which may cause data from adjacent memory to be returned to the remote attacker in the response.
This issue was reported for Vignette on IBM AIX. Other platforms may also be affected, though this has not been confirmed. The issue affects some of the default templates provided with Vignette.
** The vendor has stated that this issue is the same issue reported in BID 7296. This BID will be subsequently retired.
Exploit / POC
Vignette Memory Disclosure Vulnerability
This issue may be exploited with a web browser. The following example was submitted:
http://www.example.com/vgn/login/1,501,,00.html?cookieName=x--\>
This issue may be exploited with a web browser. The following example was submitted:
http://www.example.com/vgn/login/1,501,,00.html?cookieName=x--\>
Solution / Fix
Vignette Memory Disclosure Vulnerability
Solution:
The vendor has posted a response to this issue at the following location:
http://support.vignette.com/VOLSS/KB/View/1,,5557,00.html
It should be noted that only existing Vignette customers and partners are able to access the above link.
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
The vendor has posted a response to this issue at the following location:
http://support.vignette.com/VOLSS/KB/View/1,,5557,00.html
It should be noted that only existing Vignette customers and partners are able to access the above link.
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.