Kolibri WebServer HTTP POST Request Handling Remote Stack Buffer Overflow

2014-10-1000:00:00

SAINT Corporation

download.saintcorporation.com

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

0.116 Low

EPSS

Percentile

95.3%

JSON

Added: 10/10/2014
CVE: CVE-2014-5289
BID: 69263
OSVDB: 110142

Background

SENKAS Kolibri Webserver is a free very simple web server for Microsoft Windows that supports serving static web content.

Problem

Kolibri Webserver is vulnerable to a stack buffer overflow as a result of failure to properly validate user-supplied input when handling HTTP POST requests. A successful remote attacker could potentially execute arbitray code in the context of the Kolibri server.

Resolution

Deploy an alternate web server product or apply a patch when and if it becomes available.

References

<http://www.securityfocus.com/archive/1/533150/30/270/threaded>

Limitations

Exploit works against Kolibri Webserver 2.0 running on English versions of Windows XP SP2 32-bit, Windows XP SP3 32-bit and Windows 7 32-bit and 64-bit.