--------------------

Product: Sambar Server

Vendor: Sambar Technologies

Versions:

VULNERABLE

- 6.0 ?

- 5.x

- 4.x

- 3.x

NOT VULNERABLE

- ?

---------------------

Description:

Multi-threaded, extensible Application Server with highly programmable

API

Virtual domain support (currently name based) with independent

document/CGI directories, log files, and error templates.

HTTP 1.1 KeepAlive (performance enhancing) and byte-range (download

resume) support

Dynamic content compression

HTTPS (SSL) 128-bit encrytion support (OpenSSL included)

Integrated Log File Analysis

Documents and images can be cached in memory for performance

Document and CGI directory aliasing

Customizable and scriptable error templates allow database and email

notification.

Graphing performance monitors and automatic log file report generation.

Bandwidth and per-user throttling.

Dynamic pages using CGI, ISAPI, JAVA, and SSI. Internal ODBC allows

connections to most database types (Oracle, MS-SQL, MySQL, Access, etc)

Built-in SQL RDBMS (SQLite) for prototyping and modest projects.

-----------------------------------------

SECURITY HOLES FOUND and PROOFS OF CONCEPT:

-----------------------------------------

I encountered a buffer overflow vulnerability in the search system by

perl file ( search.pl ) , with this you can

corrupt the stack . The failure occurs when you send a specially crafted

query.

---------------------

| BUFFER OVERFLOW |

| IN SEARCH.PL |

---------------------

Code with the hole:

_______________________________________________________

# Buffer the POST content

read(STDIN, $buffer, $ENV{'CONTENT_LENGTH'});

# Process the name=value argument pairs

my $pair;

my $name;

my $value;

my @args = split(/&/, $buffer);

foreach $pair (@args)

{

($name, $value) = split(/=/, $pair);

# Unescape the argument value

$value =~ tr/+/ /; <--- LOOK HERE

$value =~ s/%([a-fA-F0-9][a-fA-F0-9])/pack("C", hex($1))/eg;

# Save the name=value pair for use below.

$FORM{$name} = $value;

}

________________________________________________________

Proof of Concepts:

You must do a request in post mode to the search.pl script with the

following content:

QUERY TO USE FOR THE BUFFER OVERFLOW:

.+.+a+.+b+.+c+.+d+.+E+.+D+.+gh+sd+.+sF+.+.+G0+.+H0+.+J1+.+L2+.+2M+.+G0

You can send other queries including + and . too but you must include

other characters.

I think that the problem is in the form that search.pl recognices the

query logic operator and the +.

The search.pl crashes and the sambar server crashes too, if you continue

sending this requests the server machine

must be restarted. The search.pl script doesn't have a limit of

characters in the query.

-----------

| CONTACT |

-----------

Lorenzo Hernandez Garcia-Hierro

--- Computer Security Analyzer ---

--Nova Projects Professional Coding--

PGP: Keyfingerprint

B6D7 5FCC 78B4 97C1 4010 56BC 0E5F 2AB2

ID: 0x9C38E1D7

**********************************

www.novappc.com

security.novappc.com

www.lorenzohgh.com

______________________

[ reply ]