|
Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com |
[Full-Disclosure] unace-2.x buffer overflow
From: Ulf Härnhammar (Ulf.Harnhammar.9485
student.uu.se)
Date: Thu Mar 03 2005 - 18:20:58 CST
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]
One of the buffer overflows in unace-1.x affects unace-2.x as well.
The Gentoo guys originally found this in a bug report [1] where they
were testing unace-2.2 after upgrading unace-1.2b. As stated there,
unace-2.2 crashes when listing (l), testing (t) or verbosely listing
(v) my bufoflow1.ace archive.
I looked further into this, and I found that it in fact is an
exploitable buffer overflow where the attacker controls EIP. I also
found that it affects all versions of unace-2.x that I checked,
namely 2.04, 2.2 and 2.5.
I also checked WinAce running on Windows XP for this bug with
inconclusive results.
[1] http://bugs.gentoo.org/show_bug.cgi?id=81958
// Ulf Härnhammar
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html
- application/octet-stream attachment: bufoflow1.ace
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]