PT-2003-2207 · Unknown · Http Fetcher

Daniel Ahlberg · Published 2003-12-31 · Updated 2016-10-18 · CVE-2003-1262

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions HTTP Fetcher versions 1.0.0 through 1.0.1

Description The issue is related to a buffer overflow in the http fetch function, which can be triggered by a remote attacker sending a URL request with a long value in the host, referer, or userAgent fields. This can cause a denial of service (crash) and potentially allow the execution of arbitrary code.

Recommendations For HTTP Fetcher versions 1.0.0 and 1.0.1, consider restricting the length of the host, referer, and userAgent values in URL requests to prevent buffer overflow exploitation. As a temporary workaround, restrict access to the http fetch function until a patch is available. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

Related Identifiers

CVE-2003-1262

Affected Products

Http Fetcher

References · 7

• 🔥 http://securityfocus.com/archive/1/305340 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2003-1262 · Security Note
• http://linuxsecurity.com/content/view/104480/104 · Vendor Advisory
• http://securityfocus.com/bid/6531 · Patch
• http://iss.net/security_center/static/11000.php · Note
• http://marc.info/?l=bugtraq&m=104195613529429&w=2 · Note
• http://secunia.com/advisories/7823 · Note