Multiple Newsreader Applications .NZB File Remote Heap Overflow Vulnerability

Bugtraq ID:	22620
Class:	Boundary Condition Error
CVE:
Remote:	Yes
Local:	No
Published:	Feb 19 2007 12:00AM
Updated:	Feb 20 2007 11:16PM
Credit:	MarsupilamiPowa is credited with the discovery of this issue.
Vulnerable:	NewsReactor NewsReactor 0 NewsBin Pro NewsBin Pro 4.3.2 NewsBin Pro NewsBin Pro 5.33
Not Vulnerable:

Multiple Newsreader Applications .NZB File Remote Heap Overflow Vulnerability

NewsReactor and NewsBin Pro are prone to a remote heap-based buffer-overflow because they fail to perform sufficient boundary checks on user-supplied data before copying it to a buffer.

An attacker could leverage this issue to execute arbitrary code with administrative privileges. A successful exploit could result in the complete compromise of the affected system.

Multiple Newsreader Applications .NZB File Remote Heap Overflow Vulnerability

Sample exploit code has been provided:

• /data/vulnerabilities/exploits/22620.c

Multiple Newsreader Applications .NZB File Remote Heap Overflow Vulnerability

Solution:
The vendor has released version 6.1r1c to address this issue. Please see the references for more information.

Multiple Newsreader Applications .NZB File Remote Heap Overflow Vulnerability

References:

• NewsBin Pro Homepage (NewsBin Pro )
  
• NewsReactor Homepage (NewsReactor)