CVE-2012-10053 Simple Web Server Connection Header Buffer Overflow
CriticalCVSS 9.3
EPSS 1.9%
Framework module
- Published
- Updated
- Exploit status
- Public exploit available
Description
Simple Web Server 2.2 rc2 contains a stack-based buffer overflow vulnerability in its handling of the Connection HTTP header. When a remote attacker sends an overly long string in this header, the server uses vsprintf() without proper bounds checking, leading to a buffer overflow on the stack. This flaw allows remote attackers to execute arbitrary code with the privileges of the web server process. The vulnerability is triggered before authentication.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pmsoftware simple web server | = 2.2 rc2 | No fix listed |
References
- raw.githubusercontent.com exploit
- www.exploit-db.com exploit
- www.exploit-db.com exploit
- ghostinthelab.wordpress.com exploit technical-description
- www.pmx.it product
- www.vulncheck.com third-party-advisory