PT-2009-2986 · W3C · W3C Amaya Web Browser

Alfredo Ortega + 1 · Published 2009-01-28 · Updated 2018-10-11 · CVE-2009-0323

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions W3C Amaya Web Browser versions 10.0 through 11.0

Description The issue is related to multiple stack-based buffer overflows that allow remote attackers to execute arbitrary code. This can be achieved via a long type parameter in an input tag, which is not properly handled by the EndOfXmlAttributeValue function, or an "HTML GI" in a start tag, which is not properly handled by the ProcessStartGI function. Additionally, there are unspecified vectors in html2thot.c and xml2thot.c related to the msgBuffer variable.

Recommendations For W3C Amaya Web Browser versions 10.0 through 11.0, at the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2009-0323

Affected Products

W3C Amaya Web Browser

References · 7

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/amaya_bdo.rb · Exploit
• 🔥 http://coresecurity.com/content/amaya-buffer-overflows · Exploit
• 🔥 https://exploit-db.com/exploits/7902 · Exploit
• 🔥 https://exploit-db.com/exploits/16548 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-0323 · Security Note
• http://securityfocus.com/archive/1/500492/100/0/threaded · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/48325 · Note