[prev in list] [next in list] [prev in thread] [next in thread] 

List:       bugtraq
Subject:    Cain & Abel PSK Sniffer Heap overflow
From:       "Gary O'leary-Steele" <garyo () sec-1 ! com>
Date:       2005-03-18 11:06:09
Message-ID: CGEFLMEEBIBHFEFOJCBDAECHDIAA.garyo () sec-1 ! com
[Download RAW message or body]

                                SEC-1 LTD.
                              www.sec-1.com

                             Security Advisory

Advisory Name:	Cain & Abel PSK Sniffer Heap overflow
 Release Date:	18/03/2005
  Application: 	Cain & Abel 2.65

	Platform: 	Win32
	Severity: 	Remote Code Execution
	Author:	Gary O'leary-Steele

Vendor Status: 	Fixed 16/03/2005
CVE Candidate: 	N/A
    Reference:	http://www.oxid.it


Overview:

Cain & Abel is a password recovery tool for Microsoft Operating Systems.
It allows easy recovery of various kind of passwords by sniffing the
network,
cracking encrypted passwords using Dictionary, Brute-Force and Cryptanalysis
attacks,
recording VoIP conversations, decoding scrambled passwords, revealing
password boxes
and analyzing routing protocols.


Details:

Sec-1 has identified a exploitable Heap Overflow within the PSK Sniffer
which could lead to arbitrary code execution.

By sending a large 'ID' parameter within the IKE packet it is possible to
overwrite
critical portions of the heap which could lead to remote code execution or a
denial
of service condition. Sec-1 were able to exploit this vulnerability by
overwriting the
pointer to RtlEnterCriticalSection().

Vendor Response:

Reported 15/03/05 fixed 16/03/05. Extremely fast response!!

Version 2.66 resolves the problem.

Download it at: http://www.oxid.it/cain.html


Common Vulnerabilities and Exposures (CVE) Information:

The Common Vulnerabilities and Exposures (CVE) project has assigned
the following names to these issues.  These are candidates for
inclusion in the CVE list (http://cve.mitre.org), which standardizes
names for security problems.

NOT_YET_CONFIRMED

Copyright 2005 Sec-1 LTD. All rights reserved.


******************************************************************************************************************************************************************
                
NEW: Sec-1 Hacking Training - Learn to breach network security to further your \
                knowledge and protect your network \
                http://www.sec-1.com/applied_hacking_course.html
******************************************************************************************************************************************************************



[prev in list] [next in list] [prev in thread] [next in thread] 

Configure | About | News | Add a list | Sponsored by KoreLogic