--------------------

Product: Sambar Server

Vendor: Sambar Technologies 

Versions:

         VULNERABLE

         

         - 6.0 ?

         - 5.x

         - 4.x

         - 3.x

        

         NOT VULNERABLE

        

         - ?

---------------------



Description:



Multi-threaded, extensible Application Server with highly programmable 

API 

Virtual domain support (currently name based) with independent 

document/CGI directories, log files, and error templates. 

HTTP 1.1 KeepAlive (performance enhancing) and byte-range (download 

resume) support 

Dynamic content compression 

HTTPS (SSL) 128-bit encrytion support (OpenSSL included) 

Integrated Log File Analysis 

Documents and images can be cached in memory for performance 

Document and CGI directory aliasing 

Customizable and scriptable error templates allow database and email 

notification.



Graphing performance monitors and automatic log file report generation. 

Bandwidth and per-user throttling. 

Dynamic pages using CGI, ISAPI, JAVA, and SSI. Internal ODBC allows 

connections to most database types (Oracle, MS-SQL, MySQL, Access, etc) 

Built-in SQL RDBMS (SQLite) for prototyping and modest projects. 



-----------------------------------------

SECURITY HOLES FOUND and PROOFS OF CONCEPT:

-----------------------------------------

 

I encountered a buffer overflow vulnerability in the search system by 

perl file ( search.pl ) , with this you can

corrupt the stack . The failure occurs when you send a specially crafted 

query.



---------------------

| BUFFER OVERFLOW   |

| IN SEARCH.PL      |

---------------------



Code with the hole:

_______________________________________________________

# Buffer the POST content

 read(STDIN, $buffer, $ENV{'CONTENT_LENGTH'});



 # Process the name=value argument pairs

 my $pair;

 my $name;

 my $value;

 my @args = split(/&/, $buffer);



 foreach $pair (@args) 

 {

  ($name, $value) = split(/=/, $pair);



  # Unescape the argument value 

  $value =~ tr/+/ /;                <---  LOOK HERE

  $value =~ s/%([a-fA-F0-9][a-fA-F0-9])/pack("C", hex($1))/eg;



  # Save the name=value pair for use below.

  $FORM{$name} = $value;

 }

________________________________________________________



 

Proof of Concepts:



You must do a request in post mode to the search.pl script with the 

following content:





QUERY TO USE FOR THE BUFFER OVERFLOW:



.+.+a+.+b+.+c+.+d+.+E+.+D+.+gh+sd+.+sF+.+.+G0+.+H0+.+J1+.+L2+.+2M+.+G0



You can send other queries including + and . too but you must include 

other characters.



I think that the problem is in the form that search.pl recognices the 

query logic operator and the +.

The search.pl crashes and the sambar server crashes too, if you continue 

sending this requests the server machine

must be restarted. The search.pl script doesn't have a limit of 

characters in the query.



-----------

| CONTACT |

-----------



Lorenzo Hernandez Garcia-Hierro

 --- Computer Security Analyzer ---

 --Nova Projects Professional Coding--

 PGP: Keyfingerprint

 B6D7 5FCC 78B4 97C1  4010 56BC 0E5F 2AB2

 ID: 0x9C38E1D7

 **********************************

 www.novappc.com

 security.novappc.com

 www.lorenzohgh.com

 ______________________