PT-2003-2207 · Unknown · Http Fetcher

Daniel Ahlberg · Publicado 2003-12-31 · Atualizado 2016-10-18 · CVE-2003-1262

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions HTTP Fetcher versions 1.0.0 through 1.0.1

Description The issue is related to a buffer overflow in the http fetch function, which can be triggered by a remote attacker sending a URL request with a long value in the host, referer, or userAgent fields. This can cause a denial of service (crash) and potentially allow the execution of arbitrary code.

Recommendations For HTTP Fetcher versions 1.0.0 and 1.0.1, consider restricting the length of the host, referer, and userAgent values in URL requests to prevent buffer overflow exploitation. As a temporary workaround, restrict access to the http fetch function until a patch is available. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Correção

Identificadores relacionados

CVE-2003-1262

Produtos afetados

Http Fetcher

Referências · 7

• 🔥 http://securityfocus.com/archive/1/305340 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2003-1262 · Nota de Segurança
• http://iss.net/security_center/static/11000.php · Nota
• http://marc.info/?l=bugtraq&m=104195613529429&w=2 · Nota
• http://linuxsecurity.com/content/view/104480/104 · Aviso do Fabricante
• http://secunia.com/advisories/7823 · Nota
• http://securityfocus.com/bid/6531 · Correção