full-disclosure - [SCSA-005] Proxomitron Naoko Long Path Buffer Overflow/DoS

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <001201c1b99b$08508a50$24029dd9@tuborg>
From: kain at ircop.dk (Knud Erik Højgaard)
Subject: [SCSA-005] Proxomitron Naoko Long Path Buffer Overflow/DoS

Gr?gory Le Bras | Security Corporation wrote:
> .: Proxomitron Naoko Long Path Buffer Overflow/DoS :.
> ________________________________________________________________________
>
> Security Corporation Security Advisory [SCSA-005]
> ________________________________________________________________________

[snip]

> Sending a parameter with a buffer of 1024 bytes in length or more,
> causes Proxomitron Naoko to crash.
>
> This vulnerability can be easily exploited to execute code.
>
> Exploitation example :
>
> c:\Proxomitron>proxomitron AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
[snip A's]
> AAAAAAAAAAAAAAAAAAAA

Could you perhaps provide a real-world example where this might be used to
gain additional privileges? I fail to see the useful bit in this
vulnerability.

--
Knud