Home page logo
/

fulldisclosure logo Full Disclosure mailing list archives

Buffer-overflow in ShixxNOTE 6.net
From: Luigi Auriemma <aluigi () autistici org>
Date: Wed, 13 Oct 2004 18:55:47 +0000


#######################################################################

                             Luigi Auriemma

Application:  ShixxNote 6.net
              http://www.shixxnote.com
Versions:     6.net, doesn't exist a specific version or build number
              but the latest change in Readme.txt (something similar to
              a changelog) is 117
Platforms:    Windows
Bug:          buffer-overflow
Exploitation: remote
Date:         13 October 2004
Author:       Luigi Auriemma
              e-mail: aluigi () altervista org
              web:    http://aluigi.altervista.org


#######################################################################


1) Introduction
2) Bug
3) The Code
4) Fix


#######################################################################

===============
1) Introduction
===============


From the author:

"ShixxNOTE 6.net is a personal organizer, desktop sticky notes
(post-it) program, instant messaging application (LAN messanger) and a
communications tool used across a local network (Intranet), Internet
and via email. Perfect and ideal tool for your LAN or office
communication."


#######################################################################

======
2) Bug
======


Exists a buffer-overflow vulnerability in the field used to specify the
font to use in the messages sent by Shixxnote.
If this specific field is bigger than 1698 bytes the return address
will be fully overwritten.


#######################################################################

===========
3) The Code
===========


http://aluigi.altervista.org/poc/shixxbof.zip


#######################################################################

======
4) Fix
======


No fix.
The author is not sure if will release a new version.


#######################################################################


--- 
Luigi Auriemma
http://aluigi.altervista.org

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html


  By Date           By Thread  

Current thread:
  • Buffer-overflow in ShixxNOTE 6.net Luigi Auriemma (Oct 13)
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]