Perception LiteServe Server Log Buffer Overflow Vulnerability

Bugtraq ID:	8971
Class:	Boundary Condition Error
CVE:
Remote:	Yes
Local:	No
Published:	Nov 04 2003 12:00AM
Updated:	Nov 04 2003 12:00AM
Credit:	The disclosure of this issue has been credited to "Tri Huynh" <[email protected]>.
Vulnerable:	Perception LiteServe 2.2 Perception LiteServe 2.0.1 Perception LiteServe 2.0 2 Perception LiteServe 2.0 Perception LiteServe 1.28 Perception LiteServe 1.25
Not Vulnerable:

Perception LiteServe Server Log Buffer Overflow Vulnerability

A buffer overflow vulnerability has been reported for Perception LiteServe HTTP server. The vulnerability occurs when the web server attempts to process malformed GET requests. Reportedly, when processing overly long GET requests consisting of 1000 to 3000 character sequences.

An attacker can exploit this vulnerability by issuing a long malformed GET request in order to execute arbitrary code.

LiteServe versions 2.2 and prior have been reported to be prone to this issue.

Perception LiteServe Server Log Buffer Overflow Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Perception LiteServe Server Log Buffer Overflow Vulnerability

Solution:
Although unconfirmed, it has been reported that the vendor has released a patch to address this issue. Users are advised to contact the vendor for more information about obtaining fixes.

Perception LiteServe Server Log Buffer Overflow Vulnerability

References:

• LiteServe Product Page (Perception)
  
• Liteserve Buffer Overflow in Handling Server's Log. ("Tri Huynh" )