MemeCode Software i.Scribe Remote Format String Vulnerability

Bugtraq ID:	32497
Class:	Input Validation Error
CVE:	CVE-2008-7074
Remote:	Yes
Local:	No
Published:	Nov 27 2008 12:00AM
Updated:	Apr 16 2015 05:51PM
Credit:	Alfons Luja
Vulnerable:	MemeCode Software i.Scribe 2.00 beta MemeCode Software i.Scribe 1.88
Not Vulnerable:	MemeCode Software i.Scribe 2.00 beta9

MemeCode Software i.Scribe Remote Format String Vulnerability

MemeCode Software i.Scribe is prone to a remote format-string vulnerability because it fails to properly sanitize user-supplied input before passing it as the format specifier to a formatted-printing function.

An attacker may exploit this issue to execute arbitrary code in the context of the vulnerable application. Failed exploit attempts will likely result in a denial-of-service condition.

i.Scribe 1.88 and 2.00 beta are vulnerable; other versions may also be affected.

MemeCode Software i.Scribe Remote Format String Vulnerability

The following proof of concept is available:

• /data/vulnerabilities/exploits/32497.php

MemeCode Software i.Scribe Remote Format String Vulnerability

Solution:
The vendor released i.Scribe 2.00 beta9 to address this issue. Please see the references for more information.


MemeCode Software i.Scribe 2.00 beta

• MemeCode Software iscribe-win32-v200-beta9.exe
  http://memecode.com/scribe/data/iscribe-win32-v200-beta9.exe

MemeCode Software i.Scribe 1.88

• MemeCode Software iscribe-win32-v200-beta9.exe
  http://memecode.com/scribe/data/iscribe-win32-v200-beta9.exe

MemeCode Software i.Scribe Remote Format String Vulnerability

References:

• Beta9 Changes (MemeCode Software)
  
• i.Scribe Homepage (MemeCode Software)