Netscape 7.02 Client Detection Tool plug-in buffer overrun
From: martin rakhmanoff (jimmers_at_yandex.ru)
Date: 07/14/03
- Previous message: bugzilla_at_redhat.com: "[RHSA-2003:206-01] Updated nfs-utils packages fix denial of service vulnerability"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Date: 14 Jul 2003 14:48:24 -0000 To: bugtraq@securityfocus.com('binary' encoding is not supported, stored as-is)
Advisory name
=============
Netscape 7.02 Client Detection Tool plug-in buffer overrun
Affected software
=================
Netscape 7.02 for Windows
Problem description
===================
Netscape 7.02 (and probably earlier versions) contains Client Detection
Tool plug-in that handles application/x-cdt Mime type. One of this plug-in
routines suffers from buffer overrun. To exploit this issue one needs to
send mail message to victim with attachment that has specifically crafted
filename and entice the victim to double-click it. When the victim double
clicks the attachment then attacker's code is executed in context of
victim's user account. Proof-of-concept exploit is published in whitepaper
"CDT plug-in bug: exploit in ASCII":
http://jimmers.russia.webmatrixhosting.net/whitepapers/CDTbug.pdf
Mitigating factors
==================
Attacker must know OS and length of victim username to exploit this issue.
Also proof-of-concept exploit assumes that user runs Windows with default
settings.
Resolution
==========
Manually remove CDT plug-in (npcdt.dll) from Netscape /components folder
or upgrade to latest version of the browser that has CDT plug-in removed.
Vendor status
=============
Netscape was notified. Netscape considers this bug as "internal" so no
patch will be released.
Copyright (c) 2003 Martin Rakhmanov.
- Previous message: bugzilla_at_redhat.com: "[RHSA-2003:206-01] Updated nfs-utils packages fix denial of service vulnerability"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
