Mbedthis AppWeb 2.2.2 URL Protocol Format String Vulnerability

ID EDB-ID:30187
Type exploitdb
Reporter Nir Rachmel
Modified 2007-06-12T00:00:00


Mbedthis AppWeb 2.2.2 URL Protocol Format String Vulnerability. CVE-2007-3009. Dos exploits for multiple platform

                                            source: http://www.securityfocus.com/bid/24454/info

Mbedthis AppWeb is prone to a format-string vulnerability because the application fails to properly sanitize user-supplied input before passing it as the format specifier to a formatted-printing function.

This issue affects only applications that were built with logging enabled and installed with no "ErrorLog" directive in 'appweb.conf'.

Successful exploits may allow remote attackers to execute arbitrary code in the context of the vulnerable application. Failed exploit attempts will likely crash the application, denying further service to legitimate users.

AppWeb 2.2.2 is reported vulnerable; other versions may also be affected.

'GET %n://localhost:80/" request'