CVE-2004-0179 in Webdav Client
Summary
by MITRE
Multiple format string vulnerabilities in (1) neon 0.24.4 and earlier, and other products that use neon including (2) Cadaver, (3) Subversion, and (4) OpenOffice, allow remote malicious WebDAV servers to execute arbitrary code.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/13/2025
The vulnerability identified as CVE-2004-0179 represents a critical format string flaw affecting multiple software components that utilize the neon library for webdav operations. This vulnerability stems from improper input validation within the neon library version 0.24.4 and earlier, which is widely adopted across various applications including Cadaver, Subversion, and OpenOffice. The flaw allows malicious webdav servers to craft specially formatted responses that exploit format string vulnerabilities in the client applications, potentially leading to arbitrary code execution on vulnerable systems.
Format string vulnerabilities occur when application code uses user-supplied data as format strings without proper sanitization, creating opportunities for attackers to manipulate memory layout and execute malicious code. The neon library serves as a fundamental component for webdav protocol implementations, making this vulnerability particularly dangerous as it affects multiple applications that depend on this library. The vulnerability is classified under CWE-134 which specifically addresses the use of format strings with user-supplied data, making it a direct descendant of well-known software security weaknesses that have plagued applications for decades.
The operational impact of this vulnerability is severe as it allows remote code execution without requiring authentication or any special privileges from the attacker. When vulnerable applications such as Cadaver or Subversion process responses from malicious webdav servers, the format string vulnerabilities can be exploited to overwrite memory locations, potentially leading to stack corruption, arbitrary code execution, or denial of service conditions. This makes the vulnerability particularly attractive to attackers seeking to compromise systems through webdav interactions, as it can be triggered simply by connecting to a malicious server.
The exploitation of this vulnerability requires a malicious webdav server that can craft responses containing specially formatted strings that will be processed by vulnerable applications. Attackers can leverage this to inject shellcode into memory locations or redirect program execution flow, effectively taking control of the affected systems. This vulnerability is particularly concerning in enterprise environments where webdav access is common and where applications like Subversion are used for version control operations. The impact extends beyond individual applications to potentially affect entire network infrastructures when vulnerable systems are compromised.
Mitigation strategies for CVE-2004-0179 involve immediate patching of affected software components and updating to neon library versions that address the format string vulnerabilities. Organizations should prioritize updating Cadaver, Subversion, and OpenOffice installations to versions that either include patched neon libraries or have implemented proper input validation. Network administrators should consider implementing firewall rules that restrict webdav access to trusted servers and monitor for unusual webdav traffic patterns. Additionally, security teams should conduct comprehensive vulnerability assessments to identify all systems using affected software versions and ensure proper input validation is implemented in all webdav-related applications. The vulnerability also highlights the importance of following secure coding practices and adhering to standards such as those outlined in the OWASP Top Ten and MITRE ATT&CK framework, particularly focusing on preventing injection attacks and ensuring proper input sanitization in all network protocol implementations.