← Advisories

Unsniff Network Analyzer 1.0 (usnf) Local Heap Overflow PoC

Medium
Advisory ID
ZSL-2009-4912
Release Date
06 April 2009
Vendor
Affected Version
1.0
CVE
N/A
Tested On
Microsoft Windows XP Professional SP3 (English)
Summary

Dont just look at hex dumps and protocol trees. With Unsniff Network Analyzer, you can view network traffic at various levels of detail. View high level objects like images, video, HTML pages, VOIP calls, drill down to individual TCP sessions, then onto reassembled PDUs, then finally to individual packets. All this functionality is packed in a cool graphical interface.

Description

Unsniff Network Analyzer is prone to a heap-based buffer-overflow vulnerability because it fails to perform adequate checks on user-supplied input (.usnf file parsing). Attackers may leverage this issue to execute arbitrary code in the context of the application.

HEAP[usnfctr.exe]: Invalid allocation size - 88888880 (exceeded 7ffdefff) (998.d08): Access violation - code c0000005 (first chance) First chance exceptions are reported before any exception handling. This exception may be expected and handled. eax=00000000 ebx=00000000 ecx=22222220 edx=00000000 esi=01248c58 edi=00000000 eip=018468d1 esp=0012c754 ebp=0012c7dc iopl=0 nv up ei pl nz na po nc cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00210202 vocore2u!CatFactory_SysLASwizzle+0x24602: 018468d1 f3ab rep stos dword ptr es:[edi] Missing image name, possible paged-out or corrupt data.
Proof of Concept
Disclosure Timeline
N/A
Credits
Vulnerability discovered by Gjoko Krstic
References
Changelog
06.04.2009Initial release