full-disclosure - Buffer-overflow in ShixxNOTE 6.net

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20041013185547.6ec9fc5d.aluigi@autistici.org>
From: aluigi at autistici.org (Luigi Auriemma)
Subject: Buffer-overflow in ShixxNOTE 6.net

#######################################################################

                             Luigi Auriemma

Application:  ShixxNote 6.net
              http://www.shixxnote.com
Versions:     6.net, doesn't exist a specific version or build number
              but the latest change in Readme.txt (something similar to
              a changelog) is 117
Platforms:    Windows
Bug:          buffer-overflow
Exploitation: remote
Date:         13 October 2004
Author:       Luigi Auriemma
              e-mail: aluigi@...ervista.org
              web:    http://aluigi.altervista.org


#######################################################################


1) Introduction
2) Bug
3) The Code
4) Fix


#######################################################################

===============
1) Introduction
===============


>From the author:

"ShixxNOTE 6.net is a personal organizer, desktop sticky notes
(post-it) program, instant messaging application (LAN messanger) and a
communications tool used across a local network (Intranet), Internet
and via email. Perfect and ideal tool for your LAN or office
communication."


#######################################################################

======
2) Bug
======


Exists a buffer-overflow vulnerability in the field used to specify the
font to use in the messages sent by Shixxnote.
If this specific field is bigger than 1698 bytes the return address
will be fully overwritten.


#######################################################################

===========
3) The Code
===========


http://aluigi.altervista.org/poc/shixxbof.zip


#######################################################################

======
4) Fix
======


No fix.
The author is not sure if will release a new version.


#######################################################################


--- 
Luigi Auriemma
http://aluigi.altervista.org