PT-2006-6523 · Essentia · Essentia Web Server

Corryl · Published 2006-11-10 · Updated 2018-10-17 · CVE-2006-5850

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Essentia Web Server version 2.15

Description A stack-based buffer overflow issue allows remote attackers to execute arbitrary code via a long URI, as demonstrated by a GET or HEAD request to API endpoints such as "/api/v1/login" or "/users/{id}". This can be achieved by manipulating the uri variable.

Recommendations For Essentia Web Server version 2.15, update to a newer version that contains a fix for this issue. As a temporary workaround, consider restricting access to API endpoints that may be vulnerable to buffer overflow attacks until a patch is available. Avoid using long URIs in requests to the server until the issue is resolved.

Exploit

Fix

Related Identifiers

CVE-2006-5850

Affected Products

Essentia Web Server

References · 11

• 🔥 https://exploit-db.com/exploits/2716 · Exploit
• 🔥 http://lists.grok.org.uk/pipermail/full-disclosure/2006-November/050537.html · Exploit
• 🔥 https://exploit-db.com/exploits/21298 · Exploit
• 🔥 http://securityfocus.com/bid/20910 · Exploit
• http://secunia.com/advisories/22718 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-5850 · Security Note
• http://securityreason.com/securityalert/1846 · Note
• http://securityfocus.com/archive/1/451115/100/0/threaded · Note
• http://vupen.com/english/advisories/2006/4384 · Note
• http://securityfocus.com/archive/1/451382/100/200/threaded · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/30049 · Note