Mini-SQL w3-msql Buffer Overflow Vulnerabilities

Bugtraq ID:	898
Class:	Boundary Condition Error
CVE:
Remote:	Yes
Local:	No
Published:	Dec 27 1999 12:00AM
Updated:	Dec 27 1999 12:00AM
Credit:	First posted to Bugtraq by Zhodiac <[email protected]> on December 27, 1999.
Vulnerable:	Hughes Technologies Mini SQL (mSQL) 2.0.11
Not Vulnerable:

Mini-SQL w3-msql Buffer Overflow Vulnerabilities

w3-msql is a cgi-program shipped with Mini-SQL which acts as a web interface for msql. There are a number of buffer overflow vulnerabilities in it with one proven to be exploitable. The exploitable buffer is the content-length field and the stack is overflowed inside of a scanf() call. As a result, it is possible to execute arbitrary code remotely as the uid of the webserver (usually nobody).

Mini-SQL w3-msql Buffer Overflow Vulnerabilities

exploit available

• /data/vulnerabilities/exploits/w3-msql.c

Mini-SQL w3-msql Buffer Overflow Vulnerabilities

Solution:
!Hispahack provided the following patch in their Bugtraq post:

------ w3-msql.patch ---------

410c410
< scanf("%s ", boundary);
---
> scanf("%128s ", boundary);
418c418
< strcat(var, buffer);
---
> strncat(var, buffer,sizeof(buffer));
428c428
< scanf(" Content-Type: %s ", buffer);
---
> scanf(" Content-Type: %15360s ", buffer);

------ w3-msql.patch ---------

Currently the SecurityFocus staff are not aware of any vendor supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].

Mini-SQL w3-msql Buffer Overflow Vulnerabilities

References:

• Hughes Technology Support (Hughes Technology)
  
• MSQL Product Information (Hughes Technology)