CORE IMPACT - Support :: The First Penetration Testing Framework

RealServer array overflow exploit v1.23

Vulnerability exploited: CAN-2003-0725 - BID-8476

Category: Exploits/Remote

Exploits an array overflow bug in RealServer
This module exploits an array overflow vulnerability in RealServers and Helix Servers 8.0 and higher. The bug is present in the code for accessing RealServer's registry (or configuration options), in the constructor for the class ServRegKey (at least in the opensource version of Helix Server). The bug occurs when a string is splitted in several substrings, using '.' as separator. A pointer to each substring is added to an array with space to hold only 1024 pointers, thus, if a string with more than 1024 dots is fed to this function, the array will be overflown, and, in our case, the return address will be overwritten with a pointer to one of the substrings. There may be several ways of reaching this vulnerable code, however we are using the publicly known way to reach it: using the View Source plugging.Once a request is issued for an URL ending in ".smi" the View Source plugging is used, it then calls the registry routine to check the configuration of the request URL, and in doing so, it feeds the vulnerable function with user's supplied string. Older versions (for example RealServer 7.0) are vulnerable, but not exploitable with this same technique (if they are exploitable at all), as the buffer where the pointers are stored is dynamically allocated in the heap.After successful exploitation a level0 agent will be installed.

Supported Systems:

This module is included in the latest version of CORE IMPACT, the first automated comprehensive penetration testing product for accurately identifying information security risks. Click here to learn more about the product.