pico33.txt

` Multiple vulnerabilities in Pico Server (pServ) v3.3  
  
discovered by Raphaël Rigo  
  
Product: Pico Server (pServ)  
Affected Version: 3.3 (verified), <=3.3 probably too  
Not affected Version: 3.4  
OS affected: all  
Risk: critical  
Remote Exploit: yes  
URL: http://pserv.sourceforge.net/  
  
Overview  
========  
  
Pico Server is a small web server. It is meant to be portable and configurable.  
* small, portable  
* fast  
* CGI-BIN support  
* auto-indexing of directories  
* access and error logging (see p-reporter for an analyser)  
* forking or single-connection at choice  
  
Pico Server (pServ) is written in portable C (K&R style so it can compile on  
older compilers too) and sports several options that by means of #define  
statements can customize the behaviour, the performance and the feature set so  
to be able to fit better the the requisites.  
  
Vulnerabilities  
===============  
  
1) Directory traversal  
  
A bug in the directory parsing code allows the attacker to access any  
directory the server has the right to access.  
  
Details :  
pServ computes the depth of the directory the user tries to access in the  
variable named depthCount. This counts is decreased when a /../ is  
encountered, unfortunately, it is also increased when /./ is  
encountered, allowing the attacker to use a /./ for each /../ to make  
sure depthCount is not negative.  
  
Risk : HIGH  
The attacker may gain important information about the system that could  
lead to other attacks.  
  
Proof of concept :  
access : http://www.example.com/./../  
  
Workaround :  
There is no workaround for this vulnerability.  
  
Solution :  
Update to v3.4  
  
-----------------------------------------------------------------------  
  
2) Remote command execution  
  
The directory traversal vulnerability described above also enables  
remote command execution. This may help an attacker to compromise the  
server.  
  
Details :  
pServ considers every request beginning with /cgi-bin/ as a script  
execution.  
  
Risk : CRITICAL  
The attacker may use this vulnerability to destroy data or for other  
attacks (i.e. use wget to download root exploits).  
  
Proof of concept :  
access : http://www.example.com/cgi-bin/./.././../usr/bin/ls  
  
Workaround :  
Disable cgi-bin support at compile time.  
  
Solution :  
Update to v3.4  
  
-----------------------------------------------------------------------  
  
3) Multiple heap overflows in cgi execution  
  
The lack of bounds checking for cgi arguments allows an attacker to  
overflow the allocated memory, possibly allowing for remote code  
execution.  
  
Details :  
Each argument is allocated a buffer of size MAX_PATH_LEN (128 on Linux)  
but the attacker is only limited by the maximum request length (2048).  
The malloc'ed buffer can therefore be overflowed.  
  
Risk : HIGH  
Successful exploitation can lead to arbitrary code execution.  
  
Workaround :  
Disable cgi-bin support at compile time.  
  
Solution :  
Update to v3.4  
  
-----------------------------------------------------------------------  
  
  
Timeline  
========  
2005-05-18 Discovery  
2005-05-19 First attempt to contact developer  
2005-05-21 Second attempt  
2005-05-22 Developer reply  
2005-06-11 Fixed version 3.4 released and advisory published  
`