[NT] PIRS2007 Local Buffer Overflow Vulnerability

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

- - - - - - - - -



PIRS2007 Local Buffer Overflow Vulnerability
------------------------------------------------------------------------


SUMMARY

Poslovni informator Republike Slovenije (PIRS) 2007 is vulnerable to local
buffer overflow. It might be possible to execute arbitrary code in a
context of currently logged on user. Direct remote code execution is not
possible.

DETAILS

Analysis:
PIRS is a data collection of companies and other active business subjects
in Slovenia. The main application pirs32.exe contains buffer overflow that
may allow code execution. Input validation is not performed on search
parameter length which leads to overflow condition. Entering =>528 ASCII
characters in any input/search field within PIRS GUI will cause
application to silently crash.

Proof of concept:
The following string 512*A + 4*B + 8*A + 4*C will overwrite ECX and EIP
registers. EIP is the pointer to location where the next instruction will
be executed.

Note: because pirs32.exe silently crashes the PoC must be reproduced
inside debugger.

Solution:
Vendor has released a patch that limits the maximum search string lenght
to 255 characters.

Download link:
<http://www.pirs.si/slo/index.php?dep_id=29&help_id=60>
http://www.pirs.si/slo/index.php?dep_id=29&help_id=60

Timeline:
24.06.2007 - vulnerability discovered
25.06.2007 - vendor informed
13.07.2007 - patch released
13.07.2007 - public disclosure


ADDITIONAL INFORMATION

The information has been provided by
<mailto:edi.strosar@xxxxxxxxxxxxxxxxxxxx> Edi Strosar.



========================================


This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@xxxxxxxxxxxxxx
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@xxxxxxxxxxxxxx


====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

Relevant Pages

  • [NT] Vulnerabilities in Windows Gadgets Allows Code Execution (MS07-048)
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... contacts file in the Contacts Gadget or a user clicked on a malicious link ... Windows Vista Feed Headlines Gadget Could Allow Remote Code Execution ...
    (Securiteam)
  • [NEWS] Cisco IOS Heap-based Overflow Vulnerability
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... The Cisco Internetwork Operating System may permit arbitrary code ... Cisco IOS may be susceptible to remote code execution through attack ...
    (Securiteam)
  • [NT] Microsoft Excel Array Index Error Remote Code Execution (MS06-037)
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Microsoft Excel Array Index Error Remote Code Execution ... An array boundary condition may be violated by a malicious .xls file in ... so we the attacker can plant specific data somewhere ...
    (Securiteam)
  • [NT] Internet Explorers Image Decoder Multiple Vulnerabilities
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... a potential remote code execution path in Microsoft Internet Explorer, ... MSIE performed admirably compared to other browsers (although ... Several MSIE crash sample files from that 30-minute run are available at: ...
    (Securiteam)
  • [EXPL] Envolution PNSVlang Code Execution (Exploit)
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... There is a code execution vulnerability in Envolution. ... echo 'No response from '.$host.':'.$port; die; ...
    (Securiteam)