[VulnWatch] uuuppz.com - Advisory 002 - mIRC $asctime overflowFrom: James Martin (firstname.lastname@example.org)
- Previous message: NGSSoftware Insight Security Research: "[VulnWatch] Microsoft Internet Explorer Legacy Text Control Buffer Overflow (#NISR26082002)"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
From: "James Martin" <email@example.com> To: <firstname.lastname@example.org>, <email@example.com>, <firstname.lastname@example.org>, <email@example.com>, "Windows NTBugtraq Mailing List" <NTBUGTRAQ@LISTSERV.NTBUGTRAQ.COM>, <firstname.lastname@example.org>, <email@example.com> Date: Tue, 27 Aug 2002 14:58:50 +0100
-----BEGIN PGP SIGNED MESSAGE-----
Researched by: James Martin
Full advisory: http://www.uuuppz.com/research/adv-002-mirc.htm
Exploit: Proof of concept code available at above URL.
Version: V6.00, V6.01, V6.02.
Fix: Download mIRC 6.03 from http://www.mirc.com
Please do not download from unofficial sites, as you may
a trojaned version.
Type: Buffer Overrun
Risk: Low to High
mIRC provides scripting capabilities to allow extension of the
client. A flaw exists in the $asctime identifier, which is used to
format Unix style time stamps. Passing a string of sufficient length
to $asctime will cause a buffer overflow on the stack. This allows
the execution of byte code through calling $asctime with a carefully
The default script included with mIRC does not call $asctime at any
point. However the majority of major scripts available for download
call $asctime to decode data provided by the irc server. Many scripts
call $asctime on data provided from other remote sources. The
exploitation of this flaw therefore depends on the script installed
by the victim.
-----BEGIN PGP SIGNATURE-----
Version: PGPfreeware 7.0.3 for non-commercial use <http://www.pgp.com>
-----END PGP SIGNATURE-----