Summary
NaviCOPA Web Server is prone to a remote buffer-overflow vulnerability and an information-disclosure vulnerability because the application fails to properly bounds-check or validate user-supplied input.
Successful exploits of the buffer-overflow issue may lead to the execution of arbitrary code in the context of the application or to denial-of-service conditions. Also, attackers can exploit the information-disclosure issue to retrieve arbitrary source code in the context of the webserver process. Information harvested may aid in further attacks.
NaviCOPA Web Server 3.01 is vulnerable
other versions may also
be affected.
Solution
The vendor reports that NaviCOPA 3.01, with a release date of February 6, 2009, addresses this issue. Contact the vendor for details.
References
Severity
Classification
-
CVSS Base Score: 6.8
AV:N/AC:M/Au:N/C:P/I:P/A:P
Related Vulnerabilities
- Cherokee Terminal Escape Sequence in Logs Command Injection Vulnerability
- IBM WebSphere Application Server (WAS) Security Bypass Vulnerability - March 2011
- Apache Tomcat Multiple Security Bypass Vulnerabilities (Windows)
- Acritum Femitter Server HTTP Request Remote File Disclosure Vulnerability
- Cherokee URI Directory Traversal Vulnerability and Information Disclosure Vulnerability