CVE-2003-0400 Vignette StoryServer and Vignette V/5 does not properly calculate the size of text variables, which causes Vignette to return unauthorized portions of memory, as demonstrated using the "-->" string in...
MediumCVSS 5.0
EPSS 3.5%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Vignette StoryServer and Vignette V/5 does not properly calculate the size of text variables, which causes Vignette to return unauthorized portions of memory, as demonstrated using the "-->" string in a CookieName argument to the login template, referred to as a "memory leak" in some reports.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| vignette content suite | = 6.0 | No fix listed |
| vignette storyserver | = 4.0 | No fix listed |
| vignette storyserver | = 4.1 | No fix listed |
| vignette storyserver | = 4.2 | No fix listed |
| vignette storyserver | = 5.0 | No fix listed |
| vignette | = 5.0 | No fix listed |
References
- 20030526 S21SEC-018 - Vignette memory leak AIX Platform mailing-list
- vignette-memory-leak(12075) patch vdb-entry vendor-advisory
- www.s21sec.com vendor-advisory
- 7684 exploit vdb-entry vendor-advisory