• info
• discussion
• exploit
• solution
• references

MNOGoSearch Search.CGI UL Buffer Overflow Vulnerability

Solution:
The vendor has addressed this issue in the current version of this software and a fix is available at the cvs repository for this product:

Conectiva has released a security advisory (CLA-2003:711) and fixes to address this issue. Details regarding applying fixes can be found in the referenced advisory, fixes are linked below.


mnoGoSearch mnoGoSearch 3.1.20

• Conectiva mnogosearch-3.1.21-12434U90_2cl.i386.rpm
  Conectiva Linux 9
  ftp://atualizacoes.conectiva.com.br/9/RPMS/mnogosearch-3.1.21-12434U90 _2cl.i386.rpm


• Conectiva mnogosearch-3.1.21-12434U90_2cl.src.rpm
  Conectiva Linux 9
  ftp://atualizacoes.conectiva.com.br/9/SRPMS/mnogosearch-3.1.21-12434U9 0_2cl.src.rpm


• Conectiva mnogosearch-devel-3.1.21-12434U90_2cl.i386.rpm
  Conectiva Linux 9
  ftp://atualizacoes.conectiva.com.br/9/RPMS/mnogosearch-devel-3.1.21-12 434U90_2cl.i386.rpm


• Conectiva mnogosearch-devel-static-3.1.21-12434U90_2cl.i386.rpm
  Conectiva Linux 9
  ftp://atualizacoes.conectiva.com.br/9/RPMS/mnogosearch-devel-static-3. 1.21-12434U90_2cl.i386.rpm


• mnoGoSearch mnoGoSearch CVS
  http://www.mnogosearch.org/download.html