Heap-based buffer overflow in httpAdapter.c in httpAdapter in SBLIM SFCB before 1.3.8 might allow remote attackers to execute arbitrary code via a Content-Length HTTP header that specifies a value too small for the amount of POST data, aka bug #3001896.

This an update that fixes two security issues.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated the sources and fixed the init script.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The web server component of SBLIM-SFCB that is listening on the remote host contains multiple heap-based buffer overflows that can be triggered by sending an HTTP request with a specially crafted Content-Length header.  Specifically :

 - There is a particular scenario where heap corruption can    exist if httpMaxContentLength in sfcb.cfg is set to 0    and the Content-Length of a request is 4294967290,    getPayload() will try to memcpy() into an incorrectly    sized buffer due to wrap around (we add 8 to    Content-Length in the malloc). Also, sfcb.cfg states    that the default value for httpMaxContentLength _is_ 0,    which is untrue.

 - httpAdapter contains a heap overflow that is caused by an    HTTP request with the Content-Length value being smaller    than the actual size of the payload. The affect of this bug    can cause the handling HTTP process to crash. If the    request is specially crafted, arbitrary code execution    could occur.

Successful exploit of these vulnerabilities may result in a server crash or execution of arbitrary code in the context of the server.

ID	Name	Product	Family	Severity
49152	Fedora 13 : sblim-sfcb-1.3.8-1.fc13 (2010-10323)	Nessus	Fedora Local Security Checks	critical
49104	Fedora 12 : sblim-sfcb-1.3.8-1.fc12 (2010-12847)	Nessus	Fedora Local Security Checks	critical
46802	SBLIM-SFCB Multiple Buffer Overflows	Nessus	Web Servers	critical

Detections

Analytics

CVE-2010-1937

critical

Tenable Plugins

critical

critical

critical