Vulnerability Note VU#229955
Nobreak CrazyWWWBoard contains buffer overflow via User-Agent field
Some versions of CrazyWWWBoard contain a buffer-overflow vulnerability that can be exploited by a remote user to execute arbitrary code.
CrazyWWWBoard is a binary CGI program that is designed to provide dynamic web bulletin board services on web servers. Versions 2000p4 and 2000LEp5 of CrazyWWWBoard contain a buffer overflow vulnerability resulting from improper handling of the HTTP_USER_AGENT CGI environment variable.
A remote attacker can exploit this vulnerability to execute arbitrary code with privileges of the web server CGI process.
The CERT/CC is currently unaware of a practical solution to this problem.
Systems Affected (Learn More)
|Vendor||Status||Date Notified||Date Updated|
|Nobreak||Unknown||-||30 Jan 2002|
CVSS Metrics (Learn More)
Thanks to teleh0r for reporting this vulnerability.
This document was written by Shawn Van Ittersum.
- CVE IDs: Unknown
- Date Public: 31 Mar 2001
- Date First Published: 16 Sep 2002
- Date Last Updated: 23 Feb 2004
- Severity Metric: 4.71
- Document Revision: 7
If you have feedback, comments, or additional information about this vulnerability, please send us email.