Nobreak CrazyWWWBoard contains buffer overflow via User-Agent field

2002-09-16T00:00:00
ID VU:229955
Type cert
Reporter CERT
Modified 2004-02-23T00:00:00

Description

Overview

Some versions of CrazyWWWBoard contain a buffer-overflow vulnerability that can be exploited by a remote user to execute arbitrary code.

Description

CrazyWWWBoard is a binary CGI program that is designed to provide dynamic web bulletin board services on web servers. Versions 2000p4 and 2000LEp5 of CrazyWWWBoard contain a buffer overflow vulnerability resulting from improper handling of the HTTP_USER_AGENT CGI environment variable.


Impact

A remote attacker can exploit this vulnerability to execute arbitrary code with privileges of the web server CGI process.


Solution

The CERT/CC is currently unaware of a practical solution to this problem.


None.


Systems Affected

Vendor| Status| Date Notified| Date Updated
---|---|---|---
Nobreak| | -| 30 Jan 2002
If you are a vendor and your product is affected, let us know.

CVSS Metrics

Group | Score | Vector
---|---|---
Base | N/A | N/A
Temporal | N/A | N/A
Environmental | N/A | N/A

References

  • <http://www.crazywwwboard.com/>

Credit

Thanks to teleh0r for reporting this vulnerability.

This document was written by Shawn Van Ittersum.

Other Information

  • CVE IDs: Unknown
  • Date Public: 31 Mar 2001
  • Date First Published: 16 Sep 2002
  • Date Last Updated: 23 Feb 2004
  • Severity Metric: 4.71
  • Document Revision: 7