full-disclosure - upnphost null pointer fun

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <Pine.LNX.4.44.0411072123120.12117-100000@felinemenace.org>
From: nd at felinemenace.org (ned)
Subject: upnphost null pointer fun

unlike my other recent posts, i will revealing bug information which is 
NOT exploitable. i hope. i think they're properly diagnosed. i think.

in upnphost module which is the windows UPNP service (http://upnp.org) 
there is a couple of null pointer exceptions, i named them 'upnp1' and 
'upnp2' and POC code is availiable at http://felinemenace.org/~nd/upnp/

a quick demo using dumbug (http://phenoelit.de):
(cmdline 'python upnp1.py')
Debugger [INFO] Access violation at 5AFDDF5C
Tracer [WARNING] AccessViolation EIP = 5AFDDF5C while reading from 00000002
Tracer [WARNING] E_AccessViolation: Offending access not in mapped memory?
(cmdline 'python upnp2.py')
Debugger [INFO] Access violation at 5AFD7FEC
Tracer [WARNING] AccessViolation EIP = 5AFD7FEC while reading from 00000000
Tracer [WARNING] E_AccessViolation: Offending access not in mapped memory?

completely useless of course, does not even stop the UPNP service or lock 
up svchost. dumbug is pretty cool though when screeshots just wont do!
- nd

-- 
http://felinemenace.org/~nd