AN HTTPD CMDIS.DLL Remote Buffer Overflow Vulnerability
2005-04-08T00:00:00
ID EDB-ID:25364 Type exploitdb Reporter Tan Chew Keong Modified 2005-04-08T00:00:00
Description
AN HTTPD CMDIS.DLL Remote Buffer Overflow Vulnerability. CVE-2005-1086. Dos exploit for windows platform
source: http://www.securityfocus.com/bid/13066/info
AN HTTPD is reported prone to a remote buffer overflow vulnerability.
Specifically, the issue presents itself in 'cmdIS.DLL' which calls the 'GetEnvironmentStrings' function to copy environment variables into a finite sized process buffer.
The attacker can issue a malformed HTTP GET command including excessive data as a value for an affected HTTP header to trigger the overflow. This can lead to arbitrary code execution, allowing the attacker to gain unauthorized access in the context of the Web server.
AN HTTPD 1.42n is reported vulnerable, however, it is possible that other versions are affected as well.
GET /scripts/cmdIS.dll/cgi-bin/test.bat HTTP/1.0
user-agent: aaaaaaaaaaaaaaaaaaaaaa [approx 8300 characters] aaaaaaaaaaaaaaaaaaaa...
{"id": "EDB-ID:25364", "type": "exploitdb", "bulletinFamily": "exploit", "title": "AN HTTPD CMDIS.DLL Remote Buffer Overflow Vulnerability", "description": "AN HTTPD CMDIS.DLL Remote Buffer Overflow Vulnerability. CVE-2005-1086. Dos exploit for windows platform", "published": "2005-04-08T00:00:00", "modified": "2005-04-08T00:00:00", "cvss": {"score": 6.4, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:PARTIAL/A:PARTIAL/"}, "href": "https://www.exploit-db.com/exploits/25364/", "reporter": "Tan Chew Keong", "references": [], "cvelist": ["CVE-2005-1086"], "lastseen": "2016-02-03T01:12:15", "viewCount": 3, "enchantments": {"score": {"value": 7.2, "vector": "NONE", "modified": "2016-02-03T01:12:15", "rev": 2}, "dependencies": {"references": [{"type": "cve", "idList": ["CVE-2005-1086"]}], "modified": "2016-02-03T01:12:15", "rev": 2}, "vulnersScore": 7.2}, "sourceHref": "https://www.exploit-db.com/download/25364/", "sourceData": "source: http://www.securityfocus.com/bid/13066/info\r\n\r\nAN HTTPD is reported prone to a remote buffer overflow vulnerability.\r\n\r\nSpecifically, the issue presents itself in 'cmdIS.DLL' which calls the 'GetEnvironmentStrings' function to copy environment variables into a finite sized process buffer.\r\n\r\nThe attacker can issue a malformed HTTP GET command including excessive data as a value for an affected HTTP header to trigger the overflow. This can lead to arbitrary code execution, allowing the attacker to gain unauthorized access in the context of the Web server.\r\n\r\nAN HTTPD 1.42n is reported vulnerable, however, it is possible that other versions are affected as well. \r\n\r\nGET /scripts/cmdIS.dll/cgi-bin/test.bat HTTP/1.0\r\nuser-agent: aaaaaaaaaaaaaaaaaaaaaa [approx 8300 characters] aaaaaaaaaaaaaaaaaaaa...\r\n", "osvdbidlist": ["15361"]}
{"cve": [{"lastseen": "2020-10-03T11:34:54", "description": "Buffer overflow in the cmdIS.DLL plugin for AN HTTPD Server 1.42n allows remote attackers to execute arbitrary code via an HTTP request with a long User-Agent header.", "edition": 3, "cvss3": {}, "published": "2005-05-02T04:00:00", "title": "CVE-2005-1086", "type": "cve", "cwe": ["NVD-CWE-Other"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.4, "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 4.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2005-1086"], "modified": "2017-07-11T01:32:00", "cpe": ["cpe:/a:an:an-httpd:1.42n"], "id": "CVE-2005-1086", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2005-1086", "cvss": {"score": 6.4, "vector": "AV:N/AC:L/Au:N/C:N/I:P/A:P"}, "cpe23": ["cpe:2.3:a:an:an-httpd:1.42n:*:*:*:*:*:*:*"]}]}
