LCC-Win32 Compiled Binary Memory Disclosure Vulnerability
BID:5391
Info
LCC-Win32 Compiled Binary Memory Disclosure Vulnerability
| Bugtraq ID: | 5391 |
| Class: | Design Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Aug 02 2002 12:00AM |
| Updated: | Aug 02 2002 12:00AM |
| Credit: | Discovered by Auriemma Luigi <[email protected]>. |
| Vulnerable: |
Jacob Navia lcc-Win32 3.2 |
| Not Vulnerable: | |
Discussion
LCC-Win32 Compiled Binary Memory Disclosure Vulnerability
lcc-Win32 is a C compiler and IDE for Microsoft Windows based operating systems, written by Jacob Navia. An information disclosure vulnerability has been reported in lcc-Win32, under some versions of Windows.
When a binary file is generated by lcc-Win32, a segment of unimportant data is included after the import table. Normally, these bytes would all be set to zero. However, lcc-Win32 may fail to initialize this memory before writing it to disk. This may result in sensitive data from previous applications being disclosed to parties which recieve this binary file.
Reportedly, this vulnerability only exists when lcc-Win32 is running on Microsoft Windows 98 or ME systems.
lcc-Win32 is a C compiler and IDE for Microsoft Windows based operating systems, written by Jacob Navia. An information disclosure vulnerability has been reported in lcc-Win32, under some versions of Windows.
When a binary file is generated by lcc-Win32, a segment of unimportant data is included after the import table. Normally, these bytes would all be set to zero. However, lcc-Win32 may fail to initialize this memory before writing it to disk. This may result in sensitive data from previous applications being disclosed to parties which recieve this binary file.
Reportedly, this vulnerability only exists when lcc-Win32 is running on Microsoft Windows 98 or ME systems.
Exploit / POC
LCC-Win32 Compiled Binary Memory Disclosure Vulnerability
No exploit is required.
No exploit is required.
Solution / Fix
LCC-Win32 Compiled Binary Memory Disclosure Vulnerability
Solution:
Concerned users of lcc-Win32 may manually edit binary files and zero the relevant sections if sensitive information is found.
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Concerned users of lcc-Win32 may manually edit binary files and zero the relevant sections if sensitive information is found.
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
LCC-Win32 Compiled Binary Memory Disclosure Vulnerability
References:
References:
- lcc-Win32 Homepage (Jacob Navia)