Multiple format string vulnerabilities in (1) neon 0.24.4 and earlier, and other products that use neon including (2) Cadaver, (3) Subversion, and (4) OpenOffice, allow remote malicious WebDAV servers to execute arbitrary code.

Greuff reports that the neon WebDAV client library contains several format string bugs within error reporting code. A malicious server may exploit these bugs by sending specially crafted PROPFIND or PROPPATCH responses.

Although several applications include neon, such as cadaver and subversion, the FreeBSD Ports of these applications are not impacted.
They are specifically configured to NOT use the included neon. Only packages listed as affected in this notice are believed to be impacted.

Multiple format string vulnerabilities were discovered in neon, an HTTP and WebDAV client library. These vulnerabilities could potentially be exploited by a malicious WebDAV server to execute arbitrary code with the privileges of the process using libneon.

The remote host is affected by the vulnerability described in GLSA-200405-04 (OpenOffice.org vulnerability when using DAV servers)

    OpenOffice.org includes code from the Neon library in functions related to     publication on WebDAV servers. This library is vulnerable to several format     string attacks.
  Impact :

    If you use the WebDAV publication and connect to a malicious WebDAV server,     this server can exploit these vulnerabilities to execute arbitrary code     with the rights of the user running OpenOffice.org.
  Workaround :

    As a workaround, you should not use the WebDAV publication facilities.

The remote host is affected by the vulnerability described in GLSA-200405-01 (Multiple format string vulnerabilities in neon 0.24.4 and earlier)

    There are multiple format string vulnerabilities in libneon which may allow     a malicious WebDAV server to execute arbitrary code under the context of     the process using libneon.
  Impact :

    An attacker may be able to execute arbitrary code under the context of the     process using libneon.
  Workaround :

    A workaround is not currently known for this issue. All users are advised     to upgrade to the latest version of the affected package.

The remote host is affected by the vulnerability described in GLSA-200404-14 (Multiple format string vulnerabilities in cadaver)

    Cadaver code includes the neon library, which in versions 0.24.4 and     previous is vulnerable to multiple format string attacks. The latest     version of cadaver uses version 0.24.5 of the neon library, which makes it     immune to this vulnerability.
  Impact :

    When using cadaver to connect to an untrusted WebDAV server, this     vulnerability can allow a malicious remote server to execute arbitrary code     on the client with the rights of the user using cadaver.
  Workaround :

    A workaround is not currently known for this issue. All users are advised     to upgrade to the latest version of the affected package.

The remote host is using software based on a vulnerable version of the Neon Library, an open-source HTTP and WebDAV client library. An attacker running a malicious WebDAV server may execute arbitrary code on the host.

The OpenOffice.org office suite contains an internal libneon library which allows it to connect to WebDAV servers. This internal library is subject to the same vulnerabilities that were fixed in libneon recently. These updated packages contain fixes to libneon to correct the several format string vulnerabilities in it, as well as a heap-based buffer overflow vulnerability.

A number of various format string vulnerabilities were discovered in the error output handling of Neon, the HTTP and WebDAV client library, by Thomas Wana. These problems affect all versions of Neon from 0.19.0 up to and including 0.24.4.

All users are encouraged to upgrade. All client software using this library is affected.

Updated OpenOffice packages that fix a vulnerability in neon exploitable by a malicious DAV server are now available.

OpenOffice.org is an Open Source, community-developed, multi-platform office productivity suite. OpenOffice internally uses inbuilt code from neon, an HTTP and WebDAV client library.

Versions of the neon client library up to and including 0.24.4 have been found to contain a number of format string bugs. An attacker could create a malicious WebDAV server in such a way as to allow arbitrary code execution on the client should a user connect to it using OpenOffice. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0179 to this issue.

Users of OpenOffice are advised to upgrade to these updated packages, which contain a patch correcting this issue.

An updated cadaver package that fixes a vulnerability in neon exploitable by a malicious DAV server is now available.

cadaver is a command-line WebDAV client that uses inbuilt code from neon, an HTTP and WebDAV client library.

Versions of the neon client library up to and including 0.24.4 have been found to contain a number of format string bugs. An attacker could create a malicious WebDAV server in such a way as to allow arbitrary code execution on the client should a user connect to it using cadaver. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0179 to this issue.

Users of cadaver are advised to upgrade to this updated package, which contains a patch correcting this issue.

ID	Name	Product	Family	Severity
36636	FreeBSD : neon format string vulnerabilities (84237895-8f39-11d8-8b29-0020ed76ef5a)	Nessus	FreeBSD Local Security Checks	medium
15324	Debian DSA-487-1 : neon - format string	Nessus	Debian Local Security Checks	medium
14490	GLSA-200405-04 : OpenOffice.org vulnerability when using DAV servers	Nessus	Gentoo Local Security Checks	medium
14487	GLSA-200405-01 : Multiple format string vulnerabilities in neon 0.24.4 and earlier	Nessus	Gentoo Local Security Checks	medium
14479	GLSA-200404-14 : Multiple format string vulnerabilities in cadaver	Nessus	Gentoo Local Security Checks	medium
1779	Neon < 0.24.5 WebDAV Client Library Format String Vulnerabilities (deprecated)	Nessus Network Monitor	Web Clients	high
14176	Mandrake Linux Security Advisory : OpenOffice.org (MDKSA-2004:078)	Nessus	Mandriva Local Security Checks	high
14131	Mandrake Linux Security Advisory : libneon (MDKSA-2004:032)	Nessus	Mandriva Local Security Checks	medium
12487	RHEL 3 : openoffice.org (RHSA-2004:160)	Nessus	Red Hat Local Security Checks	medium
12486	RHEL 2.1 : cadaver (RHSA-2004:157)	Nessus	Red Hat Local Security Checks	medium

Detections

Analytics

CVE-2004-0179

critical

Tenable Plugins

medium

medium

medium

medium

medium

high

high

medium

medium

medium