full-disclosure - uuuppz.com - Advisory 002

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <004d01c24dd4$648f17a0$d200a8c0@vitalograph.ie>
From: fulldisclose at uuuppz.com (James Martin)
Subject: uuuppz.com - Advisory 002 - mIRC $asctime overflow

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

General Info
- ------------
Researched by: James Martin
Full advisory: http://www.uuuppz.com/research/adv-002-mirc.htm
Exploit: Proof of concept code available at above URL.

Product: mIRC
Website: http://www.mirc.com
Version: V6.00, V6.01, V6.02. 
Fix: Download mIRC 6.03 from http://www.mirc.com
     Please do not download from unofficial sites, as you may
download
     a trojaned version.
Type: Buffer Overrun
Risk: Low to High

Summary
- -------
mIRC provides scripting capabilities to allow extension of the
client. A flaw exists in the $asctime identifier, which is used to
format Unix style time stamps. Passing a string of sufficient length
to $asctime will cause a buffer overflow on the stack. This allows
the execution of byte code through calling $asctime with a carefully
constructed string.

The default script included with mIRC does not call $asctime at any
point. However the majority of major scripts available for download
call $asctime to decode data provided by the irc server. Many scripts
call $asctime on data provided from other remote sources. The
exploitation of this flaw therefore depends on the script installed
by the victim. 

-----BEGIN PGP SIGNATURE-----
Version: PGPfreeware 7.0.3 for non-commercial use <http://www.pgp.com>

iQA/AwUBPWuC4/L9eRNyreu5EQJe3QCgongMQqFL2oZyX1NWicRxdmdXipIAoKb0
YJPJQ+TJoz9kjC2DKkg6m5OJ
=0cKJ
-----END PGP SIGNATURE-----