Orbit Downloader 'Download Failed' Remote Buffer Overflow Vulnerability

Bugtraq ID:	28541
Class:	Boundary Condition Error
CVE:	CVE-2008-1602
Remote:	Yes
Local:	No
Published:	Apr 03 2008 12:00AM
Updated:	May 12 2008 02:15PM
Credit:	Diego Juarez from Core Security Technologies
Vulnerable:	Orbit Downloader Orbit Downloader 2.6.4 Orbit Downloader Orbit Downloader 2.6.3
Not Vulnerable:	Orbit Downloader Orbit Downloader 2.6.5

Orbit Downloader 'Download Failed' Remote Buffer Overflow Vulnerability

Orbit Downloader is prone to a remote buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied data.

An attacker can exploit this issue to execute arbitrary code with the privileges of the user running the application. Failed exploit attempts will cause a denial-of-service condition.

This issue affects versions prior to Orbit Downloader 2.6.5.

Orbit Downloader 'Download Failed' Remote Buffer Overflow Vulnerability

Core Security Technologies has developed a working commercial exploit for its CORE IMPACT product. This exploit is not otherwise publicly available or known to be circulating in the wild.

Orbit Downloader 'Download Failed' Remote Buffer Overflow Vulnerability

Solution:
The vendor has released Orbit Downloader 2.6.5. Please see the references for more information.


Orbit Downloader Orbit Downloader 2.6.3

• Orbit Downloader OrbitDownloaderSetup.exe
  http://dl.orbitdownloader.com/dl/OrbitDownloaderSetup.exe

Orbit Downloader Orbit Downloader 2.6.4

• Orbit Downloader OrbitDownloaderSetup.exe
  http://dl.orbitdownloader.com/dl/OrbitDownloaderSetup.exe

Orbit Downloader 'Download Failed' Remote Buffer Overflow Vulnerability

References:

• Orbit Downloader 'Download failed' buffer overflow (Core Security Technologies - CoreLabs Advisory)
  
• Orbit Downloader Homepage (Orbit Downloader)
  
• CORE-2008-0314 - Orbit Downloader 'Download failed' buffer overflow (CORE Security Technologies Advisories )