Festalon HES Files Remote Heap Buffer Overflow Vulnerability

Bugtraq ID:	19402
Class:	Boundary Condition Error
CVE:
Remote:	Yes
Local:	No
Published:	Aug 07 2006 12:00AM
Updated:	Aug 08 2006 08:55PM
Credit:	Luigi Auriemma is credited with the discovery of this vulnerability.
Vulnerable:	Festalon Festalon 0.5.5 Festalon Festalon 0.5
Not Vulnerable:

Festalon HES Files Remote Heap Buffer Overflow Vulnerability

A buffer-overflow vulnerability occurs in the Festalon application because the software fails to properly bounds-check user-supplied input before copying it to an insufficiently sized memory buffer.

This issue may allow attackers to execute arbitrary machine code in the context of the affected application, which may facilitate the remote compromise of affected computers.

Festalon versions 0.5.0 through 0.5.5 are vulnerable to this issue.

Festalon HES Files Remote Heap Buffer Overflow Vulnerability

Proof-of-concept exploit code is available:

• /data/vulnerabilities/exploits/festahc.c

Festalon HES Files Remote Heap Buffer Overflow Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected]:[email protected].

Festalon HES Files Remote Heap Buffer Overflow Vulnerability

References:

• Festalon Project Page (raphnet.net)
  
• heap corruption in FESTAHES_Load (Luigi Auriemma )