[16558] in bugtraq
Re: Neotrace v2.12a Buffer Overflow [?]
daemon@ATHENA.MIT.EDU (Juliano Rizzo)
Mon Sep 4 22:10:24 2000
Mime-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Message-Id: <Pine.LNX.4.10.10009041531000.4152-100000@buff.exorcist.core-sdi.com>
Date: Mon, 4 Sep 2000 15:35:49 +0300
Reply-To: Juliano Rizzo <juliano@CORE-SDI.COM>
From: Juliano Rizzo <juliano@CORE-SDI.COM>
X-To: VULN-DEV@SECURITYFOCUS.COM
To: BUGTRAQ@SECURITYFOCUS.COM
On 2/9 Juliano Rizzo wrote:
[...]
> Would be a problem if the same overflow occurs when the
> program resolves domain names or request any other
> information from a remote non trusted source.
Well, I didn't say in my last post that there is a possible exploitable
remote overflow in Neotrace v2.12a. It will crash resolving long domain
names, the target host's name or any hop in the middle. You can check it
editing the hosts file:
10.0.66.6 AAAAAAAAAAAAAAAAAAAAAAAAAAAAAA(a lot)
Then try to use Neotrace against that ip, the AA's string will be
lowercased before overflow.
May be there are other exploitable bugs in this program, all the code
should be checked if it try to be a secure application.
--
Juliano Rizzo <juliano@core-sdi.com>
[www.core-sdi.com]
julianor.tripod.com
