full-disclosure - Netcat v1.11 , fixed release by VulnWatch, get it!

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <005001c4ecc9$6e9d4a00$0200a8c0@box>
From: class101 at gmail.com (class 101)
Subject: 
	Netcat v1.11 , fixed release by VulnWatch, get it!

thx to mr wysopal at vulnwatch for the bugfixed release:

Application: Netcat for Windows 1.1
   Platform: Windows NT/2000/XP/2003
   Severity: Remote code execution
     Status: Fixed, new version available
       Date: 12/27/2004

Summary

Netcat for Windows 1.1 has a buffer overflow vulnerability that allows
remote execution of code. It is exposed when netcat is run using the -e
option which execs a process and pipes the listening socket io to the
stdio of the exec'd process.

Note that this issue does not exist in netcat for the unix platform.

Details

doexec.c (line 445) was missing a check to see if BufferCnt had
incremented past the end of the recieve buffer.  With the check in place
the buffer is flushed before it overwrites the end.  The following new
line adds the check.

  if (RecvBuffer[0] == '\n' || RecvBuffer[0] == '\r' ||
      BufferCnt > BUFFER_SIZE-1) {

Update

A fixed version, Netcat for Windows 1.11, is available at:
http://www.vulnwatch.org/netcat/

Credit

Hat Squad discovered this vulnerabiltiy.  Hat Squad's advisory is
available at http://www.hat-squad.com/en/000142.html

-------------------------------------------------------------
class101
Hat-Squad.com
-------------------------------------------------------------
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20041228/938f57c3/attachment.html