Re: Buffer overflow in iPlanet Web Server 4 server side SHTML parsing module

[Fyodor <fyodor () RELAYGROUP COM>]

> Please note that (fortunately!) Netscape Enterprise Server 3.6sp3
> (offically end-of-lifed but still widely used) does not seem vulnerable.
>
> > Overflow happens in logging function (when iWS tries to report that file
> > is not found). If exploitation is successful (or iWS segfaults), nothing
> > will remain in the logs.
>
> Note that the watchdog process will restart the Web server, so dumb,
> repetitive attacks will only effect a DoS. Intelligent attacks might be
> much, much worse. :-(


Not completely true. During in-lab experiments (while testing and developing
the exploit), I was able to hang up NES server several times, so it doesn't
die, but does not respond to any further requests either, so you have to kill
it with SIGKILL to get watchdog to restart it properly.


-Fyodor