February 19, 2003 10:55 PM EST
By
Just was browsing the Proxomitron User List at Yahoo when I came across this message by Scott R. Lemmon the author of The Proxomitron - Univeral Web Filter.
The exploit as follows:
Sending a parameter with a buffer of 1024 bytes in length or more, causes Proxomitron Naoko to crash.
This vulnerability can be easily exploited to execute code.
This was discovered and reported by Grégory Le Bras over at Security-Corp. Details of the vulnerablilty can be found at Security-Corps advisories. Scott was alerted by Grégory Le Bras that users running under a restricted environment of some type (like a public terminal) might be able to use it to bypass those restrictions if Proxomitron was already installed and could run it with a command line. Scott further advised that anyone who runs a computer with Proxomitron installed and allows any type of shell access to untrusted users might want to make sure they're restricted from running it. That information can be found at message #14704 at Proxomitron User List.
Resources:
Message #14703 -prox-list
SCSA-005.txt [Proxomitron Naoko Long Path Buffer Overflow/DoS ] [February 19th 2003]
You can syndicate our news using the file RSS 0.91, ultramode.txt, or RSS 1.0.
