Advisory:
NSAG-¹198-23.02.2006
Research:
NSA Group [Russian company on Audit of safety & Network security]
Site of Research:
http://www.nsag.ru or http://www.nsag.org
Product:
The Bat v. 3.60.07
Site of manufacturer:
www.ritlabs.com
The status:
19/11/2005 - Publication is postponed.
19/11/2005 - Manufacturer is notified.
12/12/2005 - Answer of the manufacturer.
22/02/2006 - Publication of vulnerability.
Original Advisory:
http://www.nsag.ru/vuln/953.html
Risk:
Critical
Description:
Vulnerability exists owing to insufficient check of the size of the buffer of a variable
in which it is copied data from field Subject.
Influence:
The malefactor is capable to execute an any code on a computer of the addressee of the letter.
Exploit:
If a field subject == 4038 bytes at reception of such letter there is an overflow of the buffer and
Rewriting of registers EIP and EBP, that allows the malefactor to execute
Any code in a context vulnerable The Bat appendices.
Exemple:
Subject:AAAAAAAAAAA.... 4038..... AABB
A=0x41 (hex)
B=0x42 (hex)
Condition of a code, at the moment of overflow:
New Entery point:
00420042 FE???; Unknown command // Performance of an any code!!!
Condition of registers:
EAX 01CCC4A4
ECX 00000000
EDX 0012FA5C
EBX 02A4EB40
ESP 0012F9EC
EBP 00410041 thebat.00410041
A A
ESI 00000004
EDI 02A231F0
EIP 00420042 thebat.00420042
B B
Decision:
Download new version.
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Our company is the independent auditor of the software in market IT.
At present independent audit of the software becomes the standard practice
and we suggest to make a let out product as much as possible protected from a various sort of attacks of malefactors!
www.nsag.ru
?Nemesis? © 2006
------------------------------------
Nemesis Security Audit Group © 2006.
