[NT] PIRS2007 Local Buffer Overflow Vulnerability

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

- - - - - - - - -

PIRS2007 Local Buffer Overflow Vulnerability
------------------------------------------------------------------------

SUMMARY

Poslovni informator Republike Slovenije (PIRS) 2007 is vulnerable to local
buffer overflow. It might be possible to execute arbitrary code in a
context of currently logged on user. Direct remote code execution is not
possible.

DETAILS

Analysis:
PIRS is a data collection of companies and other active business subjects
in Slovenia. The main application pirs32.exe contains buffer overflow that
may allow code execution. Input validation is not performed on search
parameter length which leads to overflow condition. Entering =>528 ASCII
characters in any input/search field within PIRS GUI will cause
application to silently crash.

Proof of concept:
The following string 512*A + 4*B + 8*A + 4*C will overwrite ECX and EIP
registers. EIP is the pointer to location where the next instruction will
be executed.

Note: because pirs32.exe silently crashes the PoC must be reproduced
inside debugger.

Solution:
Vendor has released a patch that limits the maximum search string lenght
to 255 characters.

Download link:
<http://www.pirs.si/slo/index.php?dep_id=29&help_id=60>

http://www.pirs.si/slo/index.php?dep_id=29&help_id=60

Timeline:
24.06.2007 - vulnerability discovered
25.06.2007 - vendor informed
13.07.2007 - patch released
13.07.2007 - public disclosure

ADDITIONAL INFORMATION

The information has been provided by
<mailto:edi.strosar@varnostne-novice.com> Edi Strosar.

========================================

This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.