ShixxNOTE 6.net Remote Buffer Overflow Vulnerability

Bugtraq ID:	11409
Class:	Boundary Condition Error
CVE:	CVE-2004-1595
Remote:	Yes
Local:	No
Published:	Oct 13 2004 12:00AM
Updated:	Nov 15 2007 12:36AM
Credit:	Luigi Auriemma <[email protected]> disclosed this vulnerability.
Vulnerable:	ShixxNOTE ShixxNOTE 6.net
Not Vulnerable:

ShixxNOTE 6.net Remote Buffer Overflow Vulnerability

ShixxNOTE 6.net is reported susceptible to a remote buffer-overflow vulnerability. This issue is due to the application's failure to properly perform boundary checks before copying user-supplied strings into finite process buffers.

An attacker may leverage this issue to execute arbitrary code on a vulnerable computer with the privileges of the user running the vulnerable application.

ShixxNOTE 6.net Remote Buffer Overflow Vulnerability

Example exploits have been provided by Luigi Auriemma and "class 101" <[email protected]>:

• /data/vulnerabilities/exploits/shixxbof.zip
• /data/vulnerabilities/exploits/101_shixx.cpp
• /data/vulnerabilities/exploits/shixxnote_font.pm

ShixxNOTE 6.net Remote Buffer Overflow Vulnerability

Solution:
The vendor has released an update to address this issue. Please see the references for more information.

ShixxNOTE 6.net Remote Buffer Overflow Vulnerability

References:

• ShixxNOTE 6.net Changelog (ShixxNOTE)
  
• ShixxNOTE 6.net Home Page (ShixxNOTE)
  
• Buffer-overflow in ShixxNOTE 6.net (Luigi Auriemma )