I've done a quick debugging session: The overflow does not seem exploitable other then a DoS. What happens is that there is not enough heap to hold the long strings so it writes past the heap to a location where no memory is allocated. This will cause an unhandled exception. Kind regards, Berend-Jan Wever. ----- Original Message ----- From: "D4rkGr3y" <grey_1999at_private> To: <bugtraqat_private>; <bugtraqat_private> Sent: Friday, May 30, 2003 1:09 Subject: Tornado www-server v1.2: directory traversal, buffer overflow <snip> > This server is one BiG problem. IMHO is most dangerous server. > Main bug in DNA ;D Attacker may see any files in system (but > only if he know path and filename), may crash server (and exec > malicious code) by sending long http request. Examples: > > www.server.com/../existing_file <-file be showed > > www.server.com/aa[more than 471 chars] > | | > #--------------------------------------------------------------# > | Exploit: | > ~~~~~~~~ > > Naah, its not interesting. Lets authors code something better. <snip>
This archive was generated by hypermail 2b30 : Tue Jun 03 2003 - 12:10:58 PDT