Bugtraq mailing list archives
Re: Re: Gadu-Gadu Local/Remote Buffer Overflow vulnerability
From: j00ru.vx () gmail com
Date: 23 Nov 2007 16:55:36 -0000
Hi JD, 1. It was fully tested on Windows XP SP2 (lang: polish) with all patches, I'm going to test it on other systems. DEP wasn't turned on, I suppose this hack might not work with the DEP protection. This issue is exploitable on both both privileged/unprivileged user. 2. I did it because of a few reasons. Firstly, the user doesn't have to replace any file, it's enought to place it in a new directory in \Gadu-Gadu\emots\ ;> Of course not everyone can do it. It is a local buffer overflow indeed, but I think that emots.txt files are supposed to be harmless by the GG users. What is more, there is a number of people downloading new sets of emoticons, and a great part of them don't check the configuration file contents. IMO a nasty exploit would spread pretty easily, after all. 3. What do you mean by asking "how much bytes can you parse"? Regards, j00ru//vx
Current thread:
- Gadu-Gadu Local/Remote Buffer Overflow vulnerability j00ru . vx (Nov 22)
- <Possible follow-ups>
- Re: Gadu-Gadu Local/Remote Buffer Overflow vulnerability gg_vuln (Nov 22)
- Re: Re: Gadu-Gadu Local/Remote Buffer Overflow vulnerability emacs25 (Nov 23)
- Re: Re: Gadu-Gadu Local/Remote Buffer Overflow vulnerability j00ru . vx (Nov 23)
- Re: Re: Re: Gadu-Gadu Local/Remote Buffer Overflow vulnerability gynvael (Nov 23)
- Re: Re: Re: Re: Gadu-Gadu Local/Remote Buffer Overflow vulnerability sdfkjsomcoismwevoiweo (Nov 23)
- Re: Gadu-Gadu Local/Remote Buffer Overflow vulnerability emacs25 (Nov 23)
- Re: Re: Re: Re: Re: Gadu-Gadu Local/Remote Buffer Overflow vulnerability gynvael (Nov 23)