Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2003-0400: Vignette StoryServer can expose internal memory data

CVE-2003-0400 · published 23 years ago

Summary

The Vignette StoryServer and Vignette V/5 platforms miscalculate the length of text fields, which can cause them to return parts of memory that should not be visible. This could let an attacker see information that is meant to stay private. Apply the vendor’s patch or update to a fixed version as soon as possible.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
vignette	content_suite	6.0 `cpe:2.3:a:vignette:content_suite:6.0:::::::*`
vignette	storyserver	4.0 4.1 4.2 5.0 `cpe:2.3:a:vignette:storyserver:4.0:::::::*`
vignette	vignette	5.0 `cpe:2.3:a:vignette:vignette:5.0:::::::*`

Original advisory text

Vignette StoryServer and Vignette V/5 does not properly calculate the size of text variables, which causes Vignette to return unauthorized portions of memory, as demonstrated using the "-->" string in a CookieName argument to the login template, referred to as a "memory leak" in some reports.

References

http://marc.info/?l=bugtraq&m=105405985126857&w=2
http://www.iss.net/security_center/static/12075.php Patch Vendor Advisory
http://www.s21sec.com/es/avisos/s21sec-018-en.txt Vendor Advisory
http://www.securityfocus.com/bid/7684 Exploit Vendor Advisory

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker partial control (estimated)

Severity

5.0 Medium

Exploitation

3% chance of attack within 30 days

Timeline

Published30 Jun 2003

Updated4 Nov 2026

First seen29 Sep 2026

Sources

CVE-2003-0400 · NVD

Track software like this

Free during beta