vendor:
KiTTY Portable
by:
Guillaume Kaddouch
9.8
CVSS
CRITICAL
Remote Buffer Overflow
119
CWE
Product Name: KiTTY Portable
Affected Version From: 0.65.0.2p
Affected Version To: 0.65.0.2p
Patch Exists: NO
Related CWE: CVE-2015-7874
CPE: a:9bis:kitty:0.65.0.2p
Platforms Tested: Windows XP SP3 x86 (FR), Windows 7 Pro x64 (FR), Windows 10 Pro x64 builds 10240/10586 (FR)
2015
KiTTY Portable <= 0.65.0.2p Chat Remote Buffer Overflow (SEH WinXP/Win7/Win10)
A remote overflow exists in the KiTTY Chat feature, which enables a remote attacker to execute code on the vulnerable system with the rights of the current user, from Windows XP x86 to Windows 10 x64 included (builds 10240/10586). Chat feature is not enabled by default. When sending a long string to the KiTTY chat server as nickname, a crash occurs. The EIP overwrite does let little room for exploitation (offset 54) with no more than 160 to 196 bytes for the shellcode from XP to Windows10. Using a Metasploit
Mitigation:
Disable the Chat feature in KiTTY portable or update to a version without the vulnerability.