[Full-Disclosure] Eudora 5.2.1 buffer overflow DoS
From: Paul Szabo (psz_at_maths.usyd.edu.au)
To: NTBugtraq@listserv.ntbugtraq.com, firstname.lastname@example.org, email@example.com Date: Fri, 23 May 2003 11:56:28 +1000 (EST)
Building on my Eudora attachment spoof
I notice that sending a filename with many dots crashes Eudora, e.g.
Attachment Converted<CR>: "\B.A.A.A ... .A.A.A"
(with 122 repetitions of ".A") make it crash, writing an Exception.log
file. (Fewer repetitions cause no problem; more cause Eudora to crash,
without even an Exception.log.)
Eudora is then unable to start, until the offending message is removed from
In.mbx (using some utility other than Eudora itself).
I do not know if this buffer overflow is exploitable: Exception.log says
Exception code: c0000005 ACCESS_VIOLATION
Fault address: 77e873bc 01:000063bc C:\WINNT\system32\KERNEL32.DLL
(only ECX seems controllable).
(Tested with Eudora 5.2.1 on Windows 2000.)
Paul Szabo - firstname.lastname@example.org http://www.maths.usyd.edu.au:8000/u/psz/
School of Mathematics and Statistics University of Sydney 2006 Australia
Full-Disclosure - We believe in it.