Winlog Pro Malformed Packet Stack Buffer Overflow Vulnerability

Bugtraq ID:	45813
Class:	Boundary Condition Error
CVE:	CVE-2011-0517
Remote:	Yes
Local:	No
Published:	Jan 14 2011 12:00AM
Updated:	Mar 19 2015 09:45AM
Credit:	Luigi Auriemma
Vulnerable:	SIELCO SISTEMI Winlog Pro 2.7
Not Vulnerable:	SIELCO SISTEMI Winlog Pro 2.7.1

Winlog Pro Malformed Packet Stack Buffer Overflow Vulnerability

Winlog Pro is prone to a stack-based buffer-overflow vulnerability because it fails to adequately bounds-check user-supplied input.

Attackers can leverage this issue to execute arbitrary code in the context of the application. Failed attacks will cause denial-of-service conditions.

Winlog Pro 2.07.00 is vulnerable; other versions may also be affected.

Winlog Pro Malformed Packet Stack Buffer Overflow Vulnerability

Core Security Technologies has developed a working commercial exploit for its CORE IMPACT product. This exploit is not otherwise publicly available or known to be circulating in the wild.

The following proof-of-concept and exploit are available:

• /data/vulnerabilities/exploits/45813.zip
• /data/vulnerabilities/exploits/45813.rb

Winlog Pro Malformed Packet Stack Buffer Overflow Vulnerability

Solution:
Reports indicate that this issue has been fixed. Please see the references for details.

Winlog Pro Malformed Packet Stack Buffer Overflow Vulnerability

References:

• Sielco Sistemi Winlog Buffer Overflow (Luigi Auriemma)
  
• Winlog Pro Homepage (SIELCO SISTEMI)