Ethical Hacking

Learn to find vulnerabilities before the bad guys do! Gain real world hands on hacking experience in our state of the art hacking lab. Course designed and taught by expert instructors with years of penetration testing experience. 12 student maximum in every class. Certification attempt included in every package.
Computer Forensics Training at InfoSec Institute

Gain the in-demand skills of a certified computer examiner, learn to recover trace data left behind by fraud, theft, and cybercrime perpetrators. Discover the source of computer crime and abuse at your organization so that it never happens again. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interaction with one of our expert instructors.




Network Security Vuln-Dev
[Top] [All Lists]
<prev [Date] next>
[Advanced]
 <prev [Thread] next>

Re: Re: Gadu-Gadu Local/Remote Buffer Overflow vulnerability

from [j00ru . vx] Network Security [Permanent Link]
Subject: Re: Re: Gadu-Gadu Local/Remote Buffer Overflow vulnerability
Date: 23 Nov 2007 16:55:36 -0000 
Hi JD,

1. It was fully tested on Windows XP SP2 (lang: polish) with all patches, I'm 
going to test it on other systems. DEP wasn't turned on, I suppose this hack 
might not work with the DEP protection. This issue is exploitable on both both 
privileged/unprivileged user.

2. I did it because of a few reasons. Firstly, the user doesn't have to replace 
any file, it's enought to place it in a new directory in \Gadu-Gadu\emots\ ;> 
Of course not everyone can do it.
It is a local buffer overflow indeed, but I think that emots.txt files are 
supposed to be harmless by the GG users. What is more, there is a number of 
people downloading new sets of emoticons, and a great part of them don't check 
the configuration file contents. IMO a nasty exploit would spread pretty 
easily, after all.

3. What do you mean by asking "how much bytes can you parse"?

Regards,
j00ru//vx
[More messages with this same subject...]




<Prev in Thread] Current Thread [Next in Thread>
Previous by Date:  Re: MyBlog (MyCMS) Remote PHP Code execution / PHP Code injection .., BlackHawk
Next by Date:  Re: Re: Re: Gadu-Gadu Local/Remote Buffer Overflow vulnerability, gynvael
Previous by Thread:  Re: Re: Gadu-Gadu Local/Remote Buffer Overflow vulnerability, emacs25
Next by Thread:  Re: Re: Re: Gadu-Gadu Local/Remote Buffer Overflow vulnerability, gynvael
Indexes:  [Date] [Thread] [Top] [All Lists]