Vulnerability Development mailing list archives
exdploiting the recent windows media player nsc buffer overflow
From: Franklin DeMatto <franklin () qdefense com>
Date: Sun, 05 Aug 2001 07:40:55 -0400
WMP converts the IP Address field into unicode. This will insert null bytes into every other byte in the buffer, making it very hard to exploit (although it may be possible, like the folks at eeye did with a similar conversion in one of their recent IIS exploits)
However, if an nsc file can use unicode directly, than an attacker would be able to put unicode in the ip addr field, bypassing the conversion, and easily sploiting. I have searched through the microsoft documentation, but not been able to determine if nsc 's can be written using unicode characters (like HTML can). Anyone have any info?
Franklin DeMatto - http://qDefense.com qDefense - DEFENDING THE ELECTRONIC FRONTIER Please do not send mail to antispaam () qdefense com
Current thread:
- exdploiting the recent windows media player nsc buffer overflow Franklin DeMatto (Aug 05)
- <Possible follow-ups>
- Re: exdploiting the recent windows media player nsc buffer overflow Pauli Ojanpera (Aug 05)