[NT] ShixxNote Remote Buffer Overflow

From: SecuriTeam (support_at_securiteam.com)
Date: 10/18/04

  • Next message: SecuriTeam: "[UNIX] Libtiff Image Decoder Parsing Flaws" 
    To: list@securiteam.com
Date: 18 Oct 2004 10:17:49 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    The SecuriTeam alerts list - Free, Accurate, Independent.

    Get your security news from a reliable source.
    http://www.securiteam.com/mailinglist.html

    - - - - - - - - -

      ShixxNote Remote Buffer Overflow
    ------------------------------------------------------------------------

    SUMMARY

    " <http://www.shixxnote.com> ShixxNOTE 6.net is a personal organizer,
    desktop sticky notes (post-it) program, instant messaging application (LAN
    messanger) and a communications tool used across a local network
    (Intranet), Internet and via email. Perfect and ideal tool for your LAN or
    office communication."

    Due to a buffer overflow in the handling of messages received by
    ShixxNote, arbitrary code execution is possible.

    DETAILS

    Vulnerable Systems:
     * ShixxNote version 6.NET, revision 117

    The buffer overflow vulnerability is caused by improper bounds checking
    when messages are received, in the field used to specify which font to use
    in the message. If this specific field is bigger than 1698 bytes the
    return address will be fully overwritten.

    A proof of concept code can be found at
    <http://aluigi.altervista.org/poc/shixxbof.zip>
    http://aluigi.altervista.org/poc/shixxbof.zip.

    ADDITIONAL INFORMATION

    The information has been provided by <mailto:aluigi@autistici.org> Luigi
    Auriemma.

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

  • Next message: SecuriTeam: "[UNIX] Libtiff Image Decoder Parsing Flaws"

    Relevant Pages