full-disclosure - Eudora 5.2.1 buffer overflow DoS

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <200305230156.h4N1uSf131753@milan.maths.usyd.edu.au>
From: psz at maths.usyd.edu.au (Paul Szabo)
Subject: Eudora 5.2.1 buffer overflow DoS

Building on my Eudora attachment spoof

  http://www.securityfocus.com/archive/1/322286

I notice that sending a filename with many dots crashes Eudora, e.g.

  From: me
  To: you

  Attachment Converted<CR>: "\B.A.A.A ... .A.A.A"

(with 122 repetitions of ".A") make it crash, writing an Exception.log
file. (Fewer repetitions cause no problem; more cause Eudora to crash,
without even an Exception.log.)

Eudora is then unable to start, until the offending message is removed from
In.mbx (using some utility other than Eudora itself).

I do not know if this buffer overflow is exploitable: Exception.log says

Exception code: c0000005 ACCESS_VIOLATION
Fault address:  77e873bc 01:000063bc C:\WINNT\system32\KERNEL32.DLL
Registers:
EAX:ffffffff
EBX:00000000
ECX:00412e35
..

(only ECX seems controllable).

(Tested with Eudora 5.2.1 on Windows 2000.)

Cheers,

Paul Szabo - psz@...hs.usyd.edu.au  http://www.maths.usyd.edu.au:8000/u/psz/
School of Mathematics and Statistics  University of Sydney   2006  Australia