|
Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com |
[SA12605] Vypress Messenger Buffer Overflow Vulnerability
From: Secunia Security Advisories (sec-adv
secunia.com)
Date: Fri Oct 01 2004 - 14:51:35 CDT
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]
TITLE:
Vypress Messenger Buffer Overflow Vulnerability
SECUNIA ADVISORY ID:
SA12605
VERIFY ADVISORY:
http://secunia.com/advisories/12605/
CRITICAL:
Moderately critical
IMPACT:
System access
WHERE:
From local network
SOFTWARE:
Vypress Messenger 3.x
http://secunia.com/product/3757/
DESCRIPTION:
Luigi Auriemma has reported a vulnerability in Vypress Messenger,
which can be exploited by malicious people to compromise a user's
system.
The vulnerability is caused due to a boundary error within a
visualisation function. This can be exploited to cause a buffer
overflow via a specially crafted message containing an overly long
string (about 776 bytes) in the first field of the message.
Successful exploitation allows execution of arbitrary code with the
privileges of the user running the program. It is possible to
compromise all vulnerable hosts on a LAN at the same time by sending
a malicious broadcast packet.
The vulnerability has been reported in version 3.5.1 and prior.
SOLUTION:
The vulnerability has been fixed in version 4.0 RC1.
http://www.vypress.com/previews/
PROVIDED AND/OR DISCOVERED BY:
Luigi Auriemma
ORIGINAL ADVISORY:
http://aluigi.altervista.org/adv/vymesbof-adv.txt
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------
Unsubscribe: Secunia Security Advisories
----------------------------------------------------------------------
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]