Some versions of CrazyWWWBoard contain a buffer-overflow vulnerability that can be exploited by a remote user to execute arbitrary code.
CrazyWWWBoard is a binary CGI program that is designed to provide dynamic web bulletin board services on web servers. Versions 2000p4 and 2000LEp5 of CrazyWWWBoard contain a buffer overflow vulnerability resulting from improper handling of the HTTP_USER_AGENT CGI environment variable.
A remote attacker can exploit this vulnerability to execute arbitrary code with privileges of the web server CGI process.
The CERT/CC is currently unaware of a practical solution to this problem.
Filter by status: All Affected Not Affected Unknown
Filter by content: __ Vendor has issued information
__ Sort by: Status Alphabetical
Affected Unknown __ Unaffected
Updated: January 30, 2002
No statement is currently available from the vendor regarding this vulnerability.
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Group | Score | Vector
Base | N/A | N/A
Temporal | N/A | N/A
Environmental | | N/A
Thanks to teleh0r for reporting this vulnerability.
This document was written by Shawn Van Ittersum.
CVE IDs: | None
Severity Metric:** | 4.71
Date Public: | 2001-03-31
Date First Published: | 2002-09-16
Date Last Updated: | 2004-02-23 22:09 UTC
Document Revision: | 7