[Full-Disclosure] The Bat! 2.01 memory corruption

• Previous message: Paul Schmehl: "RE: [Full-Disclosure] Flawed arguments (Was all that other crap about PFW day)"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

To: bugtraq <bugtraq@securityfocus.com>
Date: Fri, 16 Jan 2004 12:34:43 +0300

Dear bugtraq,

AGK (agk at sandy.ru) discovered The Bat! 2.01 to throw exception on few
messages. It looks like The Bat! 2.01 in standard configuration (with
build-in PGP support) has a bug with processing PGP signed messages
(protocol="application/pgp-signature") with multiple recursively
included parts. I did not any debugging and problem may be in something
else, but changing layout of parts and signatures makes The Bat! to read
_and write_ different unallocated memory regions, potentially it may be
exploitable to code execution. Because The Bat! has it's own exception
handler, application does not crash.

Vendor (RitLabs) was contacted and replied he was unable to reproduce
this bug in 2.03 Beta and latest release 2.02 CE is _probably_ not
vulnerable to. I did not any validation. 1.x versions are not
vulnerable.

Example of message attached.

-- 
http://www.security.nnov.ru
         /\_/\
        { , . }     |\
+--oQQo->{ ^ }<-----+ \
|  ZARAZA  U  3APA3A   } You know my name - look up my number (The Beatles)
+-------------o66o--+ /
                    |/

attached mail follows:

_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html

• message/rfc822 attachment: batcrash.msg

• Previous message: Paul Schmehl: "RE: [Full-Disclosure] Flawed arguments (Was all that other crap about PFW day)"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]