Multiple buffer overflows in (1) http.c, (2) http-retr.c, (3) main.c and other code that handles network protocols in ProZilla 1.3.6-r2 and earlier allow remote servers to execute arbitrary code via a long Location header.

Buffer overflow vulnerabilities have been reported to exist in this software package. The vulnerabilities can be triggered by a remote server and can be used to inject malicious code in the ProZilla process.

Several buffer overflows have been discovered in prozilla, a multi-threaded download accelerator which could be exploited by a remote attacker to execute arbitrary code on the victim's machine. An exploit for prozilla is already in the wild.

The remote host is using Prozilla, a download accelerator for Linux and Unix systems. The remote version of this software contains multiple security issues that may allow an attacker to execute code on the remote host.
An attacker needs to create a malicious HTTP server and entice the user to download a file on this server.

The remote host is affected by the vulnerability described in GLSA-200411-31 (ProZilla: Multiple vulnerabilities)

    ProZilla contains several exploitable buffer overflows in the code     handling the network protocols.
  Impact :

    A remote attacker could setup a malicious server and entice a user to     retrieve files from that server using ProZilla. This could lead to the     execution of arbitrary code with the rights of the user running     ProZilla.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Severity
37781	FreeBSD : ProZilla -- server response buffer overflow vulnerabilities (1a32e8ee-3edb-11d9-8699-00065be4b5b6)	Nessus	FreeBSD Local Security Checks	critical
16284	Debian DSA-663-1 : prozilla - buffer overflows	Nessus	Debian Local Security Checks	critical
2428	ProZilla Multiple Remote Buffer Overflows	Nessus Network Monitor	Internet Messengers	critical
15818	GLSA-200411-31 : ProZilla: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical

Detections

Analytics

CVE-2004-1120

critical

Tenable Plugins

critical

critical

critical

critical