[38001] in bugtraq
Re: [HAT-SQUAD] NetCat Remote Critical Vulnerability, Poc included
daemon@ATHENA.MIT.EDU (Chris Wysopal)
Tue Dec 28 17:49:17 2004
Date: Tue, 28 Dec 2004 16:59:32 -0500 (EST)
From: Chris Wysopal <weld@vulnwatch.org>
To: Hat-Squad Security Team <bugtraq@hat-squad.com>
Cc: bugtraq@securityfocus.com
In-Reply-To: <20041227175712.8860.qmail@www.securityfocus.com>
Message-ID: <Pine.BSO.4.55.0412281658320.15101@vikki.vulnwatch.org>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Application: Netcat for Windows 1.1
Platform: Windows NT/2000/XP/2003
Severity: Remote code execution
Status: Fixed, new version available
Date: 12/27/2004
Summary
Netcat for Windows 1.1 has a buffer overflow vulnerability that allows
remote execution of code. It is exposed when netcat is run using the -e
option which execs a process and pipes the listening socket io to the
stdio of the exec'd process.
Note that this issue does not exist in netcat for the unix platform.
Details
doexec.c (line 445) was missing a check to see if BufferCnt had
incremented past the end of the recieve buffer. With the check in place
the buffer is flushed before it overwrites the end. The following new
line adds the check.
if (RecvBuffer[0] == '\n' || RecvBuffer[0] == '\r' ||
BufferCnt > BUFFER_SIZE-1) {
Update
A fixed version, Netcat for Windows 1.11, is available at:
http://www.vulnwatch.org/netcat/
Credit
Hat Squad discovered this vulnerabiltiy. Hat Squad's advisory is
available at http://www.hat-squad.com/en/000142.html
