EZMeeting EZNet.EXE Long HTTP Request Remote Buffer Overflow Vulnerability

Bugtraq ID:	9167
Class:	Boundary Condition Error
CVE:
Remote:	Yes
Local:	No
Published:	Dec 08 2003 12:00AM
Updated:	Dec 08 2003 12:00AM
Credit:	Discovery credited to Peter Winter-Smith.
Vulnerable:	eZnetwork eZ 3.5 .0 + eZnetwork eZmeeting + eZnetwork eZnetwork + eZnetwork eZphotoshare 1.1 + eZnetwork eZphotoshare 1.0 + eZnetwork eZshare eZnetwork eZ 3.4 .0 eZnetwork eZ 3.3
Not Vulnerable:

EZMeeting EZNet.EXE Long HTTP Request Remote Buffer Overflow Vulnerability

A problem has been identified in the handling of some types of requests by the eZ package, resulting in a buffer overrun. Because of this, it may be possible for a remote attacker to execute arbitrary code and gain unauthorized access to a vulnerable host.

EZMeeting EZNet.EXE Long HTTP Request Remote Buffer Overflow Vulnerability

A proof-of-concept has been made available by Peter Winter-Smith:

• /data/vulnerabilities/exploits/eZstack.pl
• /data/vulnerabilities/exploits/univezexp.pl

EZMeeting EZNet.EXE Long HTTP Request Remote Buffer Overflow Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

EZMeeting EZNet.EXE Long HTTP Request Remote Buffer Overflow Vulnerability

References:

• Company Homepage (eZnetwork)
  
• eZ Multiple Packages Stack Overflow Vulnerability ("Peter Winter-Smith" )