WordPad/riched20.dll buffer overflow

From: Pauli Ojanpera (pauli_ojanperaat_private)
Date: Thu Nov 18 1999 - 01:43:03 PST

  • Next message: Thomas Biege: "SuSE Security Announcement - syslogd (a1)" 

    Just if someone needs to know...

Win98/NT4 Riched20.dll (which WordPad uses) has a classic buffer
overflow problem with ".rtf"-files.

Crashme.rtf :
{\rtf\AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA}

A malicious document may probably abuse this to execute arbitary
code. WordPad crashes with EIP=41414141.

Someone else do deeper investigation since I don't care to.

______________________________________________________
Get Your Private, Free Email at http://www.hotmail.com

    This archive was generated by hypermail 2b30 : Fri Apr 13 2001 - 15:13:17 PDT