Popup+: remotely exploitable buffer overflow - Miranda IM

egodust · #1 18 Apr 2005, 7:02 PM

Hey,

As reported on various security lists, popup plus with smiley add support enabled causes a bug which can be used by a remote attacker to run any code of their choice. As the original author (zazoo) has gone AWOL - I've decided to offer a fix for the bug.

You can get 2.0.3.9 from http://files.miranda-im.org/testing/popupplus.zip

And the sources from
http://files.miranda-im.org/testing/popupplussrc.zip

Notes:
1) I've only fixed the buffer problem
2) There might be other bugs still left
3) The plugin is compiled without logging
4) The remotely exploitable code was in the logging code

The problem is in emoticons.cpp:90 - if smiley-add is used a logging feature writes to disk when it finds a word it can't convert into a smiley for various reasons, this fails when that word is bigger than the buffer used to store the formatted logging text:

Code:

logMessage("smileyChunk", "Probably word starts with smiley, can't replace whole one. See details below");
char buf[512];
sprintf(buf, ">>> chunk text: \"%s\" lstrlen = %d", word, lstrlen(word));
logMessage("smileyChunk", buf);
sprintf(buf,">>> S/A reported smiley length: %d", smgi.Smileylength);
logMessage("smileyChunk", buf);

The problem is that 'word' contains a remote string and its just overwritten the return jump address on the stack, Oops!