Netscape SmartDownload 1.3 Buffer Overflow Vulnerability

Bugtraq ID:	2615
Class:	Boundary Condition Error
CVE:	CVE-2001-0262
Remote:	Yes
Local:	No
Published:	Apr 13 2001 12:00AM
Updated:	Jul 11 2009 06:06AM
Credit:	Submitted to [email protected] on 2 March, 2001 by Craig Davison <[email protected]>, Ryan Russell <[email protected]> and Bruce Leidl <[email protected]>. Also discovered independently by Frank Swiderski <[email protected]> and described in
Vulnerable:	Netscape SmartDownload 1.3 - Netscape Communicator 4.77 - Netscape Communicator 4.76 - Netscape Communicator 4.75 - Netscape Communicator 4.74 - Netscape Communicator 4.73 - Netscape Communicator 4.72
Not Vulnerable:

Netscape SmartDownload 1.3 Buffer Overflow Vulnerability

Netscape SmartDownload, a download manager add-on for popular web browsers, is vulnerable to a buffer overflow. The library 'sdph20.dll' used by SmartDownload contains an URL parser function that will overflow when a user visits or is redirected to an URL longer than 271 characters.

This overflow, if successfully exploited, allows execution of arbitrary code by an attacker with the privilege level of the currently logged-in user. Under Windows 95/98/Me, this means administrative privileges.

Hosts with SmartDownload installed are vulnerable regardless of whether SmartDownload is enabled. Exploit code is available for this vulnerability.

Netscape SmartDownload 1.3 Buffer Overflow Vulnerability

A utility is available that generates a web page that will exploit this vulnerability. The exploit is intentionally crippled.

• /data/vulnerabilities/exploits/sdsploit.tar.gz

Netscape SmartDownload 1.3 Buffer Overflow Vulnerability

Solution:
Netscape has released SmartDownload 1.4, which does not contain this bug.


Netscape SmartDownload 1.3

• Netscape SmartDownload 1.4
  http://home.netscape.com/download/smartdownload.html

Netscape SmartDownload 1.3 Buffer Overflow Vulnerability

References:

• About SmartDownload (Netscape)
  
• Netscape SmartDownload Overflow (@stake)