[NEWS] DeleGate Pointer Array Overflow May Let Remote Users Execute Arbitrary Code

From: support@securiteam.com
Date: 03/10/03

  • Next message: support@securiteam.com: "[TOOL] Komodia's TCP/IP Library" 
    From: support@securiteam.com
To: list@securiteam.com
Date: 10 Mar 2003 11:37:50 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    In the US?

    Contact Beyond Security at our new California office
    housewarming rates on automated network vulnerability
    scanning. We also welcome ISPs and other resellers!

    Please contact us at: 323-882-8286 or ussales@beyondsecurity.com
    - - - - - - - - -

      DeleGate Pointer Array Overflow May Let Remote Users Execute Arbitrary
    Code
    ------------------------------------------------------------------------

    SUMMARY

     <http://www.delegate.org/delegate/> DeleGate is a multi-purpose
    application level gateway, or a proxy server that runs on multiple
    platforms (UNIX, Windows, MacOS X, and OS/2). DeleGate contains a
    vulnerability that could cause memory to be overwritten, resulting in
    pointer array overflow if a large number of User-Agent: lines are
    described in the robot.txt file.

    DETAILS

    Vulnerable systems:
     * DeleGate 8.3.4 (UNIX)
     * DeleGate 8.4.0 (Windows)

    Immune systems:
     * DeleGate 8.5.0

    When a client attempts to get a robot.txt file from a server site through
    DeleGate, DeleGate adds some rules based on this file by default, whenever
    it is run as HTTP-PROXY.

    Describing several lines of User-Agent: in the robots.txt file could cause
    memory to be overwritten, thus resulting in pointer array overflow.

    An attacker could potentially run codes of her choice through
    exploitation.

    Solution:
    Upgrade to version 8.5.0.

    ADDITIONAL INFORMATION

    The information has been provided by <mailto:snsadv@lac.co.jp> Secure Net
    Service(SNS) Security Advisory.

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

  • Next message: support@securiteam.com: "[TOOL] Komodia's TCP/IP Library"

    Relevant Pages

    • [NT] DeleGate Cross Site Scripting Vulnerability
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... DeleGate, a multifunctional Proxy ... contains a vulnerability related to a cross-site ...
      (Securiteam)
    • [NT] DoS and Directory Traversal Vulnerabilities in WebServer 4 Everyone
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... requests and to allow attackers to download files that reside the outside ...
      (Securiteam)
    • [NT] WebEasyMail Multiple Security Vulnerabilities (User disclosure, DoS)
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... to reveal which username are valid on the remote host. ...
      (Securiteam)
    • Re: problem delegating some user management power to a group
      ... What the Delegation Of Control Wizard dose is to modify the security for the ... >> You have to delegate the reset password right. ... >> Microsoft MVP - Directory Services ...
      (microsoft.public.windows.server.active_directory)
    • Re: Delegation Assistance
      ... The attributes don't correspond to what you can delegate (or give ... You will need to edit the security ... >> After looking through the delegation on a user object it doesn't ...
      (microsoft.public.windows.server.active_directory)