bugtraq - AirSnort v0.2.7 Stack Corruption DOS

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Tue, 9 Aug 2016 03:49:27 GMT
From: hyp3rlinx@...os.com
To: bugtraq@...urityfocus.com
Subject: AirSnort v0.2.7 Stack Corruption DOS

[+] Credits: Hyp3rlinx	

[+] Website: hyp3rlinx.altervista.org

[+] Source:  http://hyp3rlinx.altervista.org/advisories/AIRSNORT-STACK-CORRUPTION-DOS.txt

[+] ISR: ApparitionSec

Vendor:
==================================
sourceforge.net/projects/airsnort/

Product:
===============
AirSnort v0.2.7

AirSnort is a wireless LAN (WLAN) tool which cracks encryption keys on 802.11b WEP networks. AirSnort operates
by passively monitoring transmissions, computing the encryption key when enough packets have been gathered.

Vulnerability Type:
===================
Stack Corruption DOS

Vulnerability Details:
=====================

When open / load a corrupt 'crackfile' with bunch of 'AAAAAAAAAAAAAAAAAAAAAAAAAA's... airsnort crashes and stack is corrupted.
Under File / Load "Crack" File... open corrupt crackfile with bunch of 'A' chars then BOOM...

Tested successfully on Linux OS.

GDB reg dump

Program received signal SIGSEGV, Segmentation fault.
0xb72780e5 in __mempcpy_ia32 () from /lib/libc.so.6
(gdb) info r
eax            0x4141413b	1094795579
ecx            0x3e3	995
edx            0x829e9d8	136964568
ebx            0xb73c1000	-1220800512
esp            0xbfffe1dc	0xbfffe1dc
ebp            0x0	0x0
esi            0xb67cf00a	-1233326070
edi            0x0	0
eip            0xb72780e5	0xb72780e5 <__mempcpy_ia32+21>
eflags         0x210203	[ CF IF RF ID ]
cs             0x73	115
ss             0x7b	123
ds             0x7b	123
es             0x7b	123
fs             0x0	0
gs             0x33	51

[+] Disclaimer
The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise.
Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and
that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit
is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility
for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information
or exploits by the author or elsewhere.

HYP3RLINX