Buffer-overflow in ShixxNOTE 6.net

[Luigi Auriemma <aluigi () autistici org>]

#######################################################################

                             Luigi Auriemma

Application:  ShixxNote 6.net
              http://www.shixxnote.com
Versions:     6.net, doesn't exist a specific version or build number
              but the latest change in Readme.txt (something similar to
              a changelog) is 117
Platforms:    Windows
Bug:          buffer-overflow
Exploitation: remote
Date:         13 October 2004
Author:       Luigi Auriemma
              e-mail: aluigi () altervista org
              web:    http://aluigi.altervista.org


#######################################################################


1) Introduction
2) Bug
3) The Code
4) Fix


#######################################################################

===============
1) Introduction
===============


> From the author:

"ShixxNOTE 6.net is a personal organizer, desktop sticky notes
(post-it) program, instant messaging application (LAN messanger) and a
communications tool used across a local network (Intranet), Internet
and via email. Perfect and ideal tool for your LAN or office
communication."


#######################################################################

======
2) Bug
======


Exists a buffer-overflow vulnerability in the field used to specify the
font to use in the messages sent by Shixxnote.
If this specific field is bigger than 1698 bytes the return address
will be fully overwritten.


#######################################################################

===========
3) The Code
===========


http://aluigi.altervista.org/poc/shixxbof.zip


#######################################################################

======
4) Fix
======


No fix.
The author is not sure if will release a new version.


#######################################################################


--- 
Luigi Auriemma
http://aluigi.altervista.org

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html