Tripbit Secure Code Analizer Local fgets() Buffer Overrun
BID:8028
Info
Tripbit Secure Code Analizer Local fgets() Buffer Overrun
| Bugtraq ID: | 8028 |
| Class: | Boundary Condition Error |
| CVE: | |
| Remote: | No |
| Local: | Yes |
| Published: | Jun 24 2003 12:00AM |
| Updated: | Jun 24 2003 12:00AM |
| Credit: | The discovery of this vulnerability has been credited to "akcess ." <[email protected]>. |
| Vulnerable: |
Tripbit Secure Code Analizer 1.0 |
| Not Vulnerable: | |
Discussion
Tripbit Secure Code Analizer Local fgets() Buffer Overrun
A buffer overrun has been discovered in Tripbit Secure Code Analizer when reading data from source files. The problem occurs due to an insecure use of the fgets() function. This vulnerability could be triggered by a malicious source file containing approximately 260 or more bytes of specially formatted data. This would effectively overrun the internal memory buffer, causing adjacent stack memory to be overwritten with attacker-supplied values.
Successful exploitation of this vulnerability would result in attacker-supplied code being executed withthe privileges of the user invoking Secure Code Analizer.
A buffer overrun has been discovered in Tripbit Secure Code Analizer when reading data from source files. The problem occurs due to an insecure use of the fgets() function. This vulnerability could be triggered by a malicious source file containing approximately 260 or more bytes of specially formatted data. This would effectively overrun the internal memory buffer, causing adjacent stack memory to be overwritten with attacker-supplied values.
Successful exploitation of this vulnerability would result in attacker-supplied code being executed withthe privileges of the user invoking Secure Code Analizer.
Exploit / POC
Tripbit Secure Code Analizer Local fgets() Buffer Overrun
A proof of concept exploit was provided:
A proof of concept exploit was provided:
Solution / Fix
Tripbit Secure Code Analizer Local fgets() Buffer Overrun
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
Tripbit Secure Code Analizer Local fgets() Buffer Overrun
References:
References:
- Tripbit Security Development Home Page (Tripbit Security Development)
- Re: TA-2003-06 Directory Transversal Vulnerability in iWeb Server 2 ("akcess ."