Vulnerabilities > CVE-2005-2772 - Remote Buffer Overflow vulnerability in University of Minnesota Gopher 3.0.9

047910
CVSS 7.5 - HIGH
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
PARTIAL
Integrity impact
PARTIAL
Availability impact
PARTIAL
network
low complexity
university-of-minnesota
nessus
exploit available

Summary

Multiple stack-based buffer overflows in University of Minnesota gopher client 3.0.9 allow remote malicious servers to execute arbitrary code via (1) a long "+VIEWS:" reply, which is not properly handled in the VIfromLine function, and (2) certain arguments when launching third party programs such as a web browser from a web link, which is not properly handled in the FIOgetargv function.

Vulnerable Configurations

Part Description Count
Application
University_Of_Minnesota
1

Exploit-Db

descriptionGopher <= 3.0.9 (+VIEWS) Remote (Client Side) Buffer Overflow Exploit. CVE-2005-2772. Local exploit for linux platform
idEDB-ID:1187
last seen2016-01-31
modified2005-08-30
published2005-08-30
reportervade79
sourcehttps://www.exploit-db.com/download/1187/
titleGopher <= 3.0.9 +VIEWS Remote Client Side Buffer Overflow Exploit

Nessus

NASL familyDebian Local Security Checks
NASL idDEBIAN_DSA-832.NASL
descriptionSeveral buffer overflows have been discovered in gopher, a text-oriented client for the Gopher Distributed Hypertext protocol, that can be exploited by a malicious Gopher server.
last seen2020-06-01
modified2020-06-02
plugin id19801
published2005-10-05
reporterThis script is Copyright (C) 2005-2019 Tenable Network Security, Inc.
sourcehttps://www.tenable.com/plugins/nessus/19801
titleDebian DSA-832-1 : gopher - buffer overflows
code
#%NASL_MIN_LEVEL 80502

#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were  
# extracted from Debian Security Advisory DSA-832. The text 
# itself is copyright (C) Software in the Public Interest, Inc.
#

include("compat.inc");

if (description)
{
  script_id(19801);
  script_version("1.14");
  script_cvs_date("Date: 2019/08/02 13:32:19");

  script_cve_id("CVE-2005-2772");
  script_xref(name:"DSA", value:"832");

  script_name(english:"Debian DSA-832-1 : gopher - buffer overflows");
  script_summary(english:"Checks dpkg output for the updated package");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote Debian host is missing a security-related update."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"Several buffer overflows have been discovered in gopher, a
text-oriented client for the Gopher Distributed Hypertext protocol,
that can be exploited by a malicious Gopher server."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"http://www.debian.org/security/2005/dsa-832"
  );
  script_set_attribute(
    attribute:"solution", 
    value:
"Upgrade the gopher package.

For the old stable distribution (woody) this problem has been fixed in
version 3.0.3woody4.

For the stable distribution (sarge) this problem has been fixed in
version 3.0.7sarge2."
  );
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:gopher");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:3.0");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:3.1");

  script_set_attribute(attribute:"patch_publication_date", value:"2005/09/30");
  script_set_attribute(attribute:"plugin_publication_date", value:"2005/10/05");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2005-2019 Tenable Network Security, Inc.");
  script_family(english:"Debian Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/Debian/release", "Host/Debian/dpkg-l");

  exit(0);
}


include("audit.inc");
include("debian_package.inc");


if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (!get_kb_item("Host/Debian/release")) audit(AUDIT_OS_NOT, "Debian");
if (!get_kb_item("Host/Debian/dpkg-l")) audit(AUDIT_PACKAGE_LIST_MISSING);


flag = 0;
if (deb_check(release:"3.0", prefix:"gopher", reference:"3.0.3woody4")) flag++;
if (deb_check(release:"3.0", prefix:"gopherd", reference:"3.0.3woody4")) flag++;
if (deb_check(release:"3.1", prefix:"gopher", reference:"3.0.7sarge2")) flag++;

if (flag)
{
  if (report_verbosity > 0) security_hole(port:0, extra:deb_report_get());
  else security_hole(0);
  exit(0);
}
else audit(AUDIT_HOST_NOT, "affected");