----- Original Message ----- From: "Thomas Dullien" <dullienat_private> To: <bugtraqat_private>; "Mnemonix" <mnemonixat_private> Sent: Tuesday, November 23, 1999 12:53 PM Subject: Re: [BUGTRAQ] WordPad/riched20.dll buffer overflow > > On Sat, 20 Nov 1999 00:43:26 -0000, Mnemonix wrote: > > >This is exploitable. On both Windows NT4 and Windows 2000 the payload can be > > It is not. My assertion was based on a cursory look and the fact the return address _is_ overwritten. I'll bow to the greater and more indepth analysis of USSRLABS and Solar Eclipse. No doubt, however, there will be buffer overruns elsewhere within the application and not just after the {rtf1\AA...} part. I've not actually looked but if you do I can almost guarantee there will be more. Perhaps one of these will _not_ be restricted to A-Z and a-z and then it would have a chance of being exploitable. For example there is an {operator Name-Goes-Here} part of a windows RTF file. By doing {operatorAAA.... Name} or {operator AAAA...} may cause a buffer overrun - and one where the return address is overwritten and any characters are allowed. This is mostly conjecture however. Anyone with the time or inclination could check on this or any of the other rtf headers. > >Windows 2000 preserves the case. Both OS's have the return address > >over-written so all you have do do is find an instruction in the memory > >space that does a JMP ESP - there are quite a few floating around the place. > > Not one lies within a range we can point EIP to. Again, consider the above. The old adage "Seek and ye shall find" may be true here {or then maybe notAAAAAA....} ;-) > >For anyone interested in NT buffer overruns some useful docs on the subject > >can be found at http://www.infowar.co.uk/mnemonix > > > > Thomas Dullien > dullienat_private > Win32 Security Consultant ;-> Hire me ! Cheers, David Litchfield http://www.infowar.co.uk
This archive was generated by hypermail 2b30 : Fri Apr 13 2001 - 15:13:52 PDT