full-disclosure - Aventail Connect SSL VPN Client Buffer Overflow

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <dd5f5ac90704300930q7e33670oe73c7b5fa7b1a58@mail.gmail.com>
Date: Mon, 30 Apr 2007 18:30:07 +0200
From: "Thomas Pollet" <thomas.pollet@...il.com>
To: full-disclosure@...ts.grok.org.uk
Subject: Aventail Connect SSL VPN Client Buffer Overflow

Hello,

Aventail Connect registers a layered service provider to handle DNS queries.
When resolving a hostname the software fails to check string boundaries
properly.
As the lsp intercepts all ws2_32 dns lookups every application performing
these operations is vulnerable.

e.g.

$ ssh $(perl -e 'print "a"x2200')
Segmentation fault (core dumped)

vulnerable copy loop in asnsp.dll:

18B539F2   41                    INC ECX
18B539F3   41                    INC ECX
18B539F4   66:85D2           TEST DX,DX
18B539F7   74 0A               JE SHORT asnsp.18B53A03
18B539F9   66:8B11           MOV DX,WORD PTR DS:[ECX]
18B539FC   66:8916           MOV WORD PTR DS:[ESI],DX
18B539FF   46                   INC ESI
18B53A00   46                   INC ESI
18B53A01  ^EB EF             JMP SHORT asnsp.18B539F2

This was tested on version 4.1.2.13.
vendor: http://www.aventail.com/

Regards,
Thomas Pollet

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/