Vulnerability Note VU#229955

Nobreak CrazyWWWBoard contains buffer overflow via User-Agent field

Overview

Some versions of CrazyWWWBoard contain a buffer-overflow vulnerability that can be exploited by a remote user to execute arbitrary code.

I. Description

CrazyWWWBoard is a binary CGI program that is designed to provide dynamic web bulletin board services on web servers. Versions 2000p4 and 2000LEp5 of CrazyWWWBoard contain a buffer overflow vulnerability resulting from improper handling of the HTTP_USER_AGENT CGI environment variable.

II. Impact

A remote attacker can exploit this vulnerability to execute arbitrary code with privileges of the web server CGI process.

III. Solution

The CERT/CC is currently unaware of a practical solution to this problem.

None.

Systems Affected

Vendor	Status	Date Notified	Date Updated
Nobreak	Unknown	30-Jan-2002

References

http://www.crazywwwboard.com/

Credit

Thanks to teleh0r for reporting this vulnerability.

This document was written by Shawn Van Ittersum.

Other Information

Date Public:	2001-03-31
Date First Published:	2002-09-16
Date Last Updated:	2004-02-23
CERT Advisory:
CVE-ID(s):
NVD-ID(s):
US-CERT Technical Alerts:
Metric:	4.71
Document Revision:	7

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Get Adobe Reader