Secunia

Hamid Ebadi has discovered two vulnerabilities in MiniWeb HTTP Server, which can be exploited by malicious people to disclose sensitive information, to cause a DoS (Denial of Service), or to potentially compromise a vulnerable system.

1) A boundary error exists within the "_mwProcessReadSocket()" function in http.c. This can be exploited to cause a heap-based buffer overflow via a URL that is 3600-4000 characters long.

Successful exploitation of this vulnerability allows performing a DoS (Denial of Service) or the potential execution of arbitrary code.

2) Input passed in the URL to the "mwGetLocalFileName()" function in http.c is not properly sanitised before being used. This can be exploited to display arbitrary files with directory traversal attacks of the form ".%2e/.%2e/" or "%2e%2e/%2e%2e/".

The vulnerabilities are confirmed in version 0.8.19. Other versions may also be affected.

Solution
Restrict access to the web service.
Further details available in Customer Area

Provided and/or discovered by
Hamid Ebadi

Changelog
Further details available in Customer Area

Original Advisory
http://www.bugtraq.ir/adv/miniweb_english.pdf

Deep Links
Links available in Customer Area