Secunia Logo
Netsikker nu! 2008
 
Gattaca Server 2003 Multiple Vulnerabilities
Secunia Advisory: SA12071
Release Date: 2004-07-15
Popularity: 6,293 views

Critical:
Moderately critical
Impact: Exposure of system information
DoS
Where: From remote
Solution Status: Unpatched

Software:Gattaca Server 2003 1.x

Subscribe: Instant alerts on relevant vulnerabilities


Description:
Dr_insane has reported multiple vulnerabilities in Gattaca Server 2003, which can be exploited by malicious people to disclose system information, cause a DoS (Denial of Service), or conduct cross-site scripting attacks.

1) The installation path is returned in a error message when a NULL byte is appended to the end of an URL.

Example:
http://[victim]/%00

2) Input passed to the "Language" parameter in various scripts isn't properly validated before being used. This may cause the application to return an error message disclosing the path of the web root or consume large amounts of CPU resources.

Examples:
http://[victim]/web.tmpl?HELPID=8000&TEMPLATE=skins//water&LANGUAGE=[invalid_string]
http://[victim]/index.tmpl?HELPID=1000&TEMPLATE=skins//water&LANGUAGE=/

3) Input passed to the "TEMPLATE" and "LANGUAGE" parameters in the "web.tmpl" script isn't properly sanitised before being returned to users. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of a vulnerable website by tricking the user into visiting a malicious website or follow a specially crafted link.

Examples:
http://[victim]/web.tmpl?HELPID=8000&TEMPLATE=[code]//[code]&LANGUAGE=lang//en
http://[victim]/web.tmpl?HELPID=8000&TEMPLATE=skins//water&LANGUAGE=[code]//[code]

4) An error within the connection handling can be exploited to crash the application by establishing about 600 simultaneous connections to the services.

5) An error within the POP3 service can be exploited by malicious, authenticated users to crash the application by supplying extremely large values to the "LIST", "RETR", and "UIDL" commands.

The vulnerabilities have been reported in version 1.1.10.0. Other versions may also be affected.

Solution:
Use another product.

Provided and/or discovered by:
Dr_insane

Original Advisory:
http://members.lycos.co.uk/r34ct/main/Gattaca%20Server%202003.txt


Track this Secunia Advisory
Customers of the Secunia Vulnerability Intelligence solutions will automatically receive updates when new information regarding this advisory is released.

Read more about our Vulnerability Intelligence solutions and what they can do for you and your company.

About this Secunia Advisory
Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise.

Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.
  
Latest Advisories

Send Feedback to Secunia
If you have new information regarding this Secunia advisory or a product in our database, please send it to us using either our web form or email us at vuln@secunia.com.

Ideas, suggestions, and other feedback are most welcome.

Most Popular - 3 Hours

1. Juniper Products Neighbor Discovery Protocol Neighbor Solicitation Vulnerability // 129 views
2. SUSE update for MozillaFirefox // 93 views
3. IBM Lotus Quickr Security Issues and Denial of Service // 69 views
4. noName CMS "index.php" SQL Injection Vulnerabilities // 64 views
5. HP-UX NFS/ONCplus Denial of Service Vulnerability // 61 views
6. D-Bus "_dbus_validate_signature_with_reason()" Denial of Service // 55 views
7. iseemedia LPViewer ActiveX Control Multiple Buffer Overflow Vulnerabilities // 53 views
8. Debian update for lighttpd // 49 views
9. Kwalbum "UploaditemsPage.php" File Upload Vulnerability // 46 views
10. Microsoft Windows Vista Page Fault Handling Denial of Service // 44 views