PSOProxy Remote Buffer Overflow Vulnerability

Bugtraq ID:	9706
Class:	Boundary Condition Error
CVE:	CVE-2004-0313
Remote:	Yes
Local:	No
Published:	Feb 20 2004 12:00AM
Updated:	Jul 12 2009 03:06AM
Credit:	Disclosure of this issue is credited to "Donato Ferrante" <[email protected]>.
Vulnerable:	PSOProxy PSOProxy Server 0.91
Not Vulnerable:

PSOProxy Remote Buffer Overflow Vulnerability

It has been reported that PSOProxy is prone to a remote buffer overflow vulnerability. The issue is due to the insufficient boundary checking.

A malicious user may exploit this condition to potentially corrupt sensitive process memory in the affected process and ultimately execute arbitrary code with the privileges of the web server.

PSOProxy Remote Buffer Overflow Vulnerability

The following proof of concept exploit has been supplied:

• /data/vulnerabilities/exploits/pso-exploit.c
• /data/vulnerabilities/exploits/PSOProxy-exp.c
• /data/vulnerabilities/exploits/psoproxy-exploit.c
• /data/vulnerabilities/exploits/PSOproxyExploit.c

PSOProxy Remote Buffer Overflow Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

PSOProxy Remote Buffer Overflow Vulnerability

References:

• PSOProxy Server Home Page (PSOProxy)
  
• PSOProxy's exploit for Windows by Rosiello Security (Angelo Rosiello )
  
• Remote Buffer Overflow in PSOProxy 0.91 ("Donato Ferrante" )