Sploitus

Exploit for Sun Java System Web Server WebDAV OPTIONS request buffer overflow

saint · 2010-02-05

Exploit Code

MARKDOWN34 lines
## https://sploitus.com/exploit?id=SAINT:45ED77EFFA1D04F8768986CB9B9BD8D4
Added: 02/05/2010  
CVE: [CVE-2010-0361](<https://vulners.com/cve/CVE-2010-0361>)  
BID: [37874](<http://www.securityfocus.com/bid/37874>)  
OSVDB: [61851](<http://www.osvdb.org/61851>)  


### Background

[Sun Java System Web Server](<http://www.sun.com/software/products/web_srvr/index.xml>) is a web application server. [WebDAV](<http://www.webdav.org/>) (Web-based Distributed Authoring and Versioning) is an extension to the HTTP protocol which allows users to edit web server content. 

### Problem

A buffer overflow vulnerability in Sun Java System Web Server's WebDAV implementation allows remote attackers to execute arbitrary commands by sending a specially crafted OPTIONS request. 

### Resolution

Upgrade to Sun Java System Web Server 6.1 Service Pack 12 or 7.0 Release 8 or higher. 

### References

<http://secunia.com/advisories/38260/>  
<http://sunsolve.sun.com/search/document.do?assetkey=1-66-275850-1>  


### Limitations

Exploit works on Sun Java System Web Server 7.0 Update 7 on Windows Server 2003 SP2 with patch KB933729. 

WebDAV support must be enabled on the target in order for the exploit to succeed, and the correct WebDAV URI must be specified. 

### Platforms

Windows