AOLserver 3.0 vulnerability

From: Bob Rogers (rogers-bugtraq@rgrjr.dyndns.org)
Date: 08/23/01 

Message-ID: <15236.64804.937854.768693@h0050da615e79.ne.mediaone.net>
Date: Thu, 23 Aug 2001 08:55:00 -0400
From: Bob Rogers <rogers-bugtraq@rgrjr.dyndns.org>
To: Nate Haggard <nate@securitylogics.com>
Subject: AOLserver 3.0 vulnerability

   From: Nate Haggard <nate@securitylogics.com>
   Date: Wed, 22 Aug 2001 16:51:45 -0600

   Aolserver 3.0 will crash when it is given a long authorization string. It
   is also possible this vulnerability will allow a hacker to execute
   arbitrary code through a buffer overflow. I have not verified a buffer
   overflow exists. Aolserver 3.4 and 3.3.1 are not vulnerable to this attack.

AOLserver 3.2 is also vulnerable (Red Hat 6.0++, kernel 2.2.19).

   Here is a sample exploit
   ------------------------------------------
   . . .
   $killme = "GET / HTTP/1.0\nAuthorization: Basic ".$junk."\r\n\r\n";
   . . .

Shouldn't this be

   $killme = "GET / HTTP/1.0\r\nAuthorization: Basic ".$junk."\r\n\r\n";

instead? Doesn't matter, though; it seems to make AOLserver hang either
way.

                                        -- Bob Rogers

Relevant Pages

  • Re: AOLserver 3.0 vulnerability
    ... > Aolserver 3.0 will crash when it is given a long authorization string. ... > is also possible this vulnerability will allow a hacker to execute ... > print $remote $killme; ...
    (Bugtraq)
  • [EXPL] AOLserver Vulnerable To Host Buffer Overflow
    ... AOLserver Vulnerable To Host Buffer Overflow ... A vulnerability in the ... product allows remote users to overflow an internal buffer used by the ...
    (Securiteam)
  • [UNIX] AOLserver DB Proxy Daemon Format String Vulnerability
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... AOLserver also includes complete database integration and a dynamic page ... vulnerability in the AOLserver external database driver proxy daemon API ...
    (Securiteam)
  • AOLserver 3.0 vulnerability
    ... Aolserver 3.0 will crash when it is given a long authorization string. ... is also possible this vulnerability will allow a hacker to execute ... arbitrary code through a buffer overflow. ... print $remote $killme; ...
    (Bugtraq)
  • AOLserver 3.4.2 Unauthorized File Disclosure Vulnerability
    ... AOLserver 3.4.2 Unauthorized File Disclosure Vulnerability ... AOLserver is America Online's Open-Source web server. ...
    (NT-Bugtraq)