[22389] in bugtraq
AOLserver 3.0 vulnerability
daemon@ATHENA.MIT.EDU (Bob Rogers)
Thu Aug 23 10:40:28 2001
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Message-ID: <15236.64804.937854.768693@h0050da615e79.ne.mediaone.net>
Date: Thu, 23 Aug 2001 08:55:00 -0400
From: Bob Rogers <rogers-bugtraq@rgrjr.dyndns.org>
To: Nate Haggard <nate@securitylogics.com>
Cc: bugtraq@securityfocus.com
In-Reply-To: <5.1.0.14.0.20010822165114.00a75bf0@pop.wordplace.com>
From: Nate Haggard <nate@securitylogics.com>
Date: Wed, 22 Aug 2001 16:51:45 -0600
Aolserver 3.0 will crash when it is given a long authorization string. It
is also possible this vulnerability will allow a hacker to execute
arbitrary code through a buffer overflow. I have not verified a buffer
overflow exists. Aolserver 3.4 and 3.3.1 are not vulnerable to this attack.
AOLserver 3.2 is also vulnerable (Red Hat 6.0++, kernel 2.2.19).
Here is a sample exploit
------------------------------------------
. . .
$killme = "GET / HTTP/1.0\nAuthorization: Basic ".$junk."\r\n\r\n";
. . .
Shouldn't this be
$killme = "GET / HTTP/1.0\r\nAuthorization: Basic ".$junk."\r\n\r\n";
instead? Doesn't matter, though; it seems to make AOLserver hang either
way.
-- Bob Rogers
