Stack-based buffer overflow in pavuk 0.9pl28, 0.9pl27, and possibly other versions allows remote web sites to execute arbitrary code via a long HTTP Location header.

When pavuk sends a request to a web server and the server sends back the HTTP status code 305 (Use Proxy), pavuk copies data from the HTTP Location header in an unsafe manner. This leads to a stack-based buffer overflow with control over EIP.

The remote host is affected by the vulnerability described in GLSA-200411-19 (Pavuk: Multiple buffer overflows)

    Pavuk contains several buffer overflow vulnerabilities in the code handling digest authentication and HTTP header processing. This issue is similar to GLSA 200407-19, but contains more vulnerabilities.
  Impact :

    A remote attacker could cause a buffer overflow, leading to arbitrary code execution with the rights of the user running Pavuk.
  Workaround :

    There is no known workaround at this time.

Ulf Harnhammar discovered a vulnerability in pavuk, a file retrieval program, whereby an oversized HTTP 305 response sent by a malicious server could cause arbitrary code to be executed with the privileges of the pavuk process.

The remote host is affected by the vulnerability described in GLSA-200406-22 (Pavuk: Remote buffer overflow)

    When Pavuk connects to a web server and the server sends back the HTTP     status code 305 (Use Proxy), Pavuk copies data from the HTTP Location     header in an unsafe manner.
  Impact :

    An attacker could cause a stack-based buffer overflow which could lead     to arbitrary code execution with the rights of the user running Pavuk.
  Workaround :

    There is no known workaround at this time. All users are encouraged to     upgrade to the latest available version.

ID	Name	Product	Family	Severity
36618	FreeBSD : Pavuk HTTP Location header overflow (76904dce-ccf3-11d8-babb-000854d03344)	Nessus	FreeBSD Local Security Checks	high
15694	GLSA-200411-19 : Pavuk: Multiple buffer overflows	Nessus	Gentoo Local Security Checks	high
15364	Debian DSA-527-1 : pavuk - buffer overflow	Nessus	Debian Local Security Checks	high
14533	GLSA-200406-22 : Pavuk: Remote buffer overflow	Nessus	Gentoo Local Security Checks	high

Detections

Analytics

CVE-2004-0456

critical

Tenable Plugins

high

high

high

high