bugtraq - Re: Re: Gadu-Gadu Local/Remote Buffer Overflow vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20071123165536.29549.qmail@securityfocus.com>
Date: 23 Nov 2007 16:55:36 -0000
From: j00ru.vx@...il.com
To: bugtraq@...urityfocus.com
Subject: Re: Re: Gadu-Gadu Local/Remote Buffer Overflow vulnerability

Hi JD,

1. It was fully tested on Windows XP SP2 (lang: polish) with all patches, I'm going to test it on other systems. DEP wasn't turned on, I suppose this hack might not work with the DEP protection. This issue is exploitable on both both privileged/unprivileged user.

2. I did it because of a few reasons. Firstly, the user doesn't have to replace any file, it's enought to place it in a new directory in \Gadu-Gadu\emots\ ;> Of course not everyone can do it.
It is a local buffer overflow indeed, but I think that emots.txt files are supposed to be harmless by the GG users. What is more, there is a number of people downloading new sets of emoticons, and a great part of them don't check the configuration file contents. IMO a nasty exploit would spread pretty easily, after all.

3. What do you mean by asking "how much bytes can you parse"?

Regards,
j00ru//vx