Title: Unsniff Network Analyzer 1.0 (usnf) Local Heap Overflow PoC
Advisory ID: ZSL-2009-4912
Type: Local
Impact: System Access, DoS
Risk: (3/5)
Release Date: 06.04.2009

Summary

Dont just look at hex dumps and protocol trees. With Unsniff Network Analyzer, you can view network traffic at various levels of detail. View high level objects like images, video, HTML pages, VOIP calls, drill down to individual TCP sessions, then onto reassembled PDUs, then finally to individual packets. All this functionality is packed in a cool graphical interface.

Description

Unsniff Network Analyzer is prone to a heap-based buffer-overflow vulnerability because it fails to perform adequate checks on user-supplied input (.usnf file parsing). Attackers may leverage this issue to execute arbitrary code in the context of the application.

--------------------------------------------------------------------------------

HEAP[usnfctr.exe]: Invalid allocation size - 88888880 (exceeded 7ffdefff)
(998.d08): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=00000000 ebx=00000000 ecx=22222220 edx=00000000 esi=01248c58 edi=00000000
eip=018468d1 esp=0012c754 ebp=0012c7dc iopl=0 nv up ei pl nz na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00210202
vocore2u!CatFactory_SysLASwizzle+0x24602:
018468d1 f3ab rep stos dword ptr es:[edi]
Missing image name, possible paged-out or corrupt data.

--------------------------------------------------------------------------------

Vendor

Unleash Networks - http://www.unleashnetworks.com

Affected Version

1.0

Tested On

Microsoft Windows XP Professional SP3 (English)

Vendor Status

N/A

PoC

unsniff_heap.pl

Credits

Vulnerability discovered by Gjoko Krstic - <gjoko@zeroscience.mk>

References

[1] http://www.milw0rm.com/exploits/8360
[2] http://packetstormsecurity.org/filedesc/unsniff-overflow.txt.html
[3] http://www.securityfocus.com/bid/34396
[4] http://www.redoracle.com/index.php?option=com_exploit&task=view&type=dos&exid=1198
[5] http://www.securityreason.com/exploitalert/5992
[6] http://hack4.com/news/23846.html

Changelog

[06.04.2009] - Initial release

Contact

Zero Science Lab

Web: http://www.zeroscience.mk
e-mail: lab@zeroscience.mk