Vulnerability Note VU#705958

HAHTsite Scenario Server fails to handle overly long URLs

Overview

HAHTsite Scenario Server fails to properly handle HTTP requests containing an overly long "project name".

I. Description

HAHTsite Scenario Server is an e-Business platform that consists of a web application server and web development environment. There is a buffer overflow vulnerability in the way HAHTsite Scenario Server processes incoming HTTP requests. By supplying a specially crafted HTTP request containing an overly long "project name", a remote, unauthenticated attacker could cause the HAHTsite Scenario Server process to crash or potentially execute code of the attacker's choice.

II. Impact

A remote, unauthenticated attacker could cause the HAHTsite Scenario Server process to crash or potentially execute code of the attacker's choice.

III. Solution

Upgrade

HAHT has published a fix to address this issue. For information on obtaining this fix, please refer to HAHT Knowledge Base Article ID: 20030010.

Systems Affected

Vendor	Status	Date Notified	Date Updated
HAHT Commerce	Vulnerable	12-Apr-2004

References

http://www.protego.dk/advisories/200405.html
http://www.haht.com
http://secunia.com/advisories/11288/

Credit

This vulnerability was reported by Dennis Rand.

This document was written by Damon Morda.

Other Information

Date Public:	2004-04-02
Date First Published:	2004-04-14
Date Last Updated:	2004-04-14
CERT Advisory:
CVE-ID(s):
NVD-ID(s):
US-CERT Technical Alerts:
Metric:	10.75
Document Revision:	9

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Get Adobe Reader