PT-2002-1637 · Aol · Aolserver

Published 2002-06-11 · Updated 2008-09-05 · CVE-2002-0587

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions AOLServer versions 3.0 through 3.4.2

Description The issue is related to a buffer overflow in the Ns PdLog function of the external database driver proxy daemon library. This can be exploited by remote attackers via the Error or Notice parameters, potentially leading to a denial of service or the execution of arbitrary code.

Recommendations For AOLServer versions 3.0 through 3.4.2, consider restricting access to the vulnerable Ns PdLog function until a patch is available. Avoid using the Error or Notice parameters in the affected library to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2002-0587

Affected Products

Aolserver

References · 5

• http://sourceforge.net/tracker/index.php?func=detail&aid=533141&group_id=3152&atid=303152 · Vendor Advisory
• http://archives.neohapsis.com/archives/bugtraq/2002-04/0195.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2002-0587 · Security Note
• http://cvs.sourceforge.net/cgi-bin/viewcvs.cgi/aolserver/aolserver/nspd/log.c.diff?r1=1.4&r2=1.4.6.1 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-0587 · Note