Multiple bugs in Alibaba 2.0

[prizm () RESENTMENT ORG (Prizm)]

Details in attached file.

- Prizm


Application: Alibaba 2.0
Problem Type: Multiple Problems(3)
Author: Prizm<Prizm () RESENTMENT org>
Platform(s): Windows 95/98/NT
Vendor Status: Not Informed
Vendor Website: http://csm.alcyonis.fr

Product Description
-------------------

Alibaba is a fully functional http server for windows 95/98/NT. It supports cgi among many other
things. It is easily configurable and is quite easy to use.

Bug #1: Long GET request causes alibaba server to crash
-------------------------------------------------------

The problem, as usual, is with bounds checking.

By doing:

http://www.vulnerable.host.com/[8173 bytes]

The alibaba server will shut down.

Bug #2: Problem in multiple scripts(overwrite and byte injection)
-----------------------------------------------------------------

This was found after reading a previous report on alibaba reguarding several cgi's, get32.exe
included. get16.exe, post16.exe and post32.exe all seem to include the same vulnerability as the
one in get32.exe. Bugs in get32.exe, alibaba.pl and tst.bat were found by Kerb(kerb () fnusa com).

www.vulnerable.host.com/cgi-bin/post32.exe|echo%20>c:\text.txt
www.vulnerable.host.com/cgi-bin/post16.exe|echo%20>c:\text.txt
www.vulnerable.host.com/cgi-bin/get16.exe|echo%20>c:\text.txt

These will overwrite file.txt, or any file you specify. The get16.exe, post16.exe and post32.exe
programs will also allow the injection of code bytes into any executable file.

Bug #3: All cgi-bin scripts allow listing of alibaba directory
--------------------------------------------------------------

Simply requesting |dir%20c:\[dir] after every cgi script, you can see the contents of the
directory you specified after |dir%20 .

CGI Scripts that seem to be able to do this are: get16.exe, get32.exe, post16.exe, get32.exe,
tst.bat, tst2.bat, lsin.exe, lsindex2.bat, imapcern.exe, imapncsa.exe and aliredir.exe

Vendor Status
-------------

I didn't bother to inform the vendor because the latest version was released in 1996, so i
logically figured they had forgotten about it.

Greetings
---------

Lamagra, Scrippie, eth0, narr0w and many others...