|
ADA Image Server Request Buffer Overflow and Directory Traversal
|
|
Secunia Advisory:
|
SA11287
|
|
|
Release Date:
|
2004-04-05
|
|
Last Update:
|
2007-12-25
|
|
Popularity:
|
5,930 views
|
|
|
Critical:
|
Highly critical
|
|
Impact:
|
Exposure of system information
Exposure of sensitive information
System access
|
|
Where:
|
From remote
|
|
Solution Status:
|
Vendor Patch
|
|
| Software: | ADA Image Server (ImgSvr) 0.x
|
|
|
Subscribe:
|
Instant alerts on relevant vulnerabilities 
|
|
| CVE reference: | CVE-2004-2463
CVE-2004-2464
CVE-2006-3546
|
|
Description:
Dr_insane has discovered two vulnerabilities in ADA Image Server, which can be exploited by malicious people to compromise a vulnerable system or gain knowledge of sensitive information.
1) A boundary error within a routine for evaluating requested resources can be exploited to cause a buffer overflow via an overly long (about 1000 bytes) HTTP GET request.
Successful exploitation may allow execution of arbitrary code.
2) An input validation error can be exploited to access directories outside the web root via either the classic "../" directory traversal character sequence or the URL encoded representation of the "..//" character sequence.
This vulnerability can be combined with another recently disclosed vulnerability to view the content of arbitrary directories.
For more information:
SA11277
The vulnerabilities have been reported in versions 0.4 and 0.5 for Windows. Other versions may also be affected.
Solution:
Update to version 0.6.21 or later.
http://sourceforge.net/project/showfiles.php?group_id=61768
Provided and/or discovered by:
Dr_insane
Changelog:
2004-04-13: Added information about version 0.5.
2004-07-12: Added information about vulnerabilities in version 0.5.
2005-08-22: Added CVE reference.
2006-08-02: Added CVE reference.
2007-12-25: Updated "Solution" section.
Original Advisory:
http://members.lycos.co.uk/r34ct/main/ADA%20Image%20Server%20(ImgSvr)%200.4.txt
http://members.lycos.co.uk/r34ct/main/Ada_image_server_0.5.txt
Other References:
SA11277:
http://secunia.com/advisories/11277/
|
|
|
Track this Secunia Advisory
|
Customers of the Secunia Vulnerability Intelligence solutions will automatically receive updates when new information regarding this advisory is released.
Read more about our Vulnerability Intelligence solutions and what they can do for you and your company.
|
|
|
About this Secunia Advisory
|
Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise.
Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.
|
