General Info ------------ Researched by: James Martin Full advisory: http://www.uuuppz.com/research/adv-001-mirc.htm Exploit: Proof of concept code available at above URL. Product: mIRC Website: http://www.mirc.com Version: 5.91 and all prior versions (to be best of my knowledge). Fix: A patch will be available soon from offical mIRC sites. Please do not download from unofficial sites, as you may download a trojaned version. Type: Buffer Overrun Risk: High Summary ------- A security vulnerability has been found in the popular IRC client mIRC. The flaw allows a rogue/hacked IRC server to execute arbitary code on the victims machine. Allowing the attacker to gain full control of the victims computer. This bug affects all versions of mIRC upto and including version 5.91. An error exists in mIRC's handling of certain messages from the server, making it possible to overflow a static buffer. With carefully constructed messages arbitary code can be executed. The flaw must be exploited by a rogue server, however it is possible to cause a user to unknowingly connect to a server. If a webpage is viewed in Internet Explorer which contains specific code mIRC will attempt to connect to a server, sometimes without prompting the user for conformation.
This archive was generated by hypermail 2b30 : Mon Feb 04 2002 - 17:00:14 PST