Multiple vulnerabilities in WinShadow
Multiple vulnerabilities in WinShadow
-------------------------------------
Affected Systems: OmniCom WinShadow
version: 2.0 (and possibly earlier versions)
Vendor: OmniCom Technologies - http://www.omnicomtech.com
Issue: 1. Buffer overflow in client handling hostnames in host files
2. DoS against server
Released: 27 September 2003
Introduction:
=============
"winshdow: Create a secure remote control session on the Internet or private
WAN/LAN network allowing easy access to remote files and applications. Increase
productivity by allowing secure remote access for mobile users and system
administrators."
- Vendors Description
[ http://www.omnicomtech.com ]
Details:
========
Multiple vulnerabilities has been identified in winShadow version 2.0, which
allows malicious users to execute arbitrary code on the master client and
remotely crash the server.
Buffer Overflow:
----------------
winShadow saves hostnames in host files (*.osh), the process handing the
hostname parameter read from the file will cause a buffer overflow if
approximately 250 bytes are passed after this parameter.
Denial of Service:
------------------
By connecting to the server and issuing a long username or password, the server
will crash, refusing any further connections until the server is closed by
logging off or rebooting the system, this may be because it a service that runs
with system privileges.
Vendor status:
==============
The vendor has been informed.
Exploit:
========
Can be downloaded from http://www.elitehaven.net/winshadow.zip
The exploit was written by Peter Winter-Smith.
Discovered by/Credit:
=====================
Bahaa Naamneh
b_naamneh@xxxxxxxxxxx
http://www.bsecurity.tk