|
Brought to you by:
Suppliers of:
|
|
|
| |
mIRC "attempts to provide a user-friendly interface for use with the Internet Relay Chat network. The IRC network is a virtual meeting place where people from all over the world can meet and talk".
A buffer overflow in the way mIRC handle irc:// links allows remote attackers to cause the program to execute arbitrary code. |
| |
Credit:
The information has been provided by Phuong Nguyen.
|
| |
Vulnerable systems:
* mIRC version 6.1 and prior
Immune systems:
* mIRC version 6.11
When mIRC is installed, it registers its own handler for URL of the type "irc". Calling "irc://irc.hackme.com" from our web browser causes mirc.exe to be executed and ready to connect to irc.hackme.com server. By inputting an overly long string to the "irc" protocol, an attacker is able to overwrite the saved instruction pointer, thus controls the program's execution.
Example:
irc://[buffer]...... where's buffer >998 bytes
An attacker would be able to gain access to the target system if he was able to trick the user to load his special crafted URL. Hence, he can have his code executed under the current user's privilege.
Vendor status:
Author has released a newer version (6.11) which fixes the issue, available at http://www.mirc.com/get.html.
|
|
|
|
|
