CrazyWWWBoard HTTP_USER_AGENT CGI environment variable buffer overflow
| crazywwwboard-httpuseragent-bo (10110) |  High Risk |
Description:
CrazyWWWBoard is vulnerable to a buffer overflow, caused by insufficient bounds checking of the HTTP_USER_AGENT CGI environment variable. By supplying an overly long string to the environment variable, a remote attacker could overflow a buffer and execute arbitrary code on the system with privileges of the Web server process.
Platforms Affected:
- Nobreak Technologies, CrazyWWWBoard 2000LEp5
- Nobreak Technologies, CrazyWWWBoard 2000p4
Remedy:
No remedy available as of November 29, 2008.
Consequences:
Gain Access
References:
- CVE-2001-1457: Buffer overflow in CrazyWWWBoard 2000p4 and 2000LEp5 allows remote attackers to execute arbitrary code via a long HTTP_USER_AGENT CGI environment variable.
- US-CERT VU#229955: Nobreak CrazyWWWBoard contains buffer overflow via User-Agent field
Reported:
Sep 16, 2002
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
Copyright (c) 1994-2008 Internet Security Systems, Inc. All rights reserved worldwide.
For corrections or additions please email xforce@iss.net