Recognize-Security

Posted by Trancer on Oct 16 2009

Hello readers, I wrote a new Metaspoit exploit module for the HTTPDX h_handlepeer() function stack-based buffer overflow vulnerability.

The vulnerability was found in HTTPDX HTTP/FTP server version 1.4 by Pankaj Kohli and the original exploit can be found on his website – httpdx 1.4 GET Request Remote Buffer Overflow Exploit (0day).

This module exploits a stack-based buffer overflow vulnerability in HTTPDX HTTP server 1.4. The vulnerability is caused due to a boundary error within the “h_handlepeer()” function in http.cpp. By sending an overly long HTTP request, an attacker can overrun a buffer and execute arbitrary code.

Download httpdx_handlepeer.rb.
Also on Metasploit.

References:
CVE-2009-3711
OSVDB 58714

Categories: Exploits, Metasploit

0 Comments | Comments RSS | TrackBack URL

---