BeyondCHM 1.1 – Buffer Overflow
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ============================================================================= ============================================================================= BeyondCHM 1.1 Buffer Overflow (price 32.56 EUR) Url: http://www.beyondchm.com/ Author: shinnai mail: shinnai[at]autistici[dot]org site: http://shinnai.altervista.org/ This was written for educational purpose. Use it at your own risk. Author will be not responsible for any damage. Tested on: Microsoft Windows 7 Professional 6.1.7601 Service Pack 1 build 7601 Info (http://www.beyondchm.com/): Beyond CHM is a powerful chm reader and chm editor, It enables user to open multiple tabs at the same time. With this CHM viewer, user can edit CHM files, including highlighting CHM text, changing font and font size, removing contents, adding comments and so on, all the changes can be saved persistently. Additionally, user can switch Beyond CHM between reader mode and editor mode easily. In reader mode, users can zoom on CHM pages and navigate among CHM pages easily. Beyond CHM is a good Microsoft HTML Help Tool replacement, which supports nearly all Windows operation systems. PoC released as is, I have no time at the moment for further investigations ============================================================================= ============================================================================= Crafting a .chm file is possible to cause a stack based buffer overflow. PoC: http://shinnai.altervista.org/exploits/chm.rar https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/18776.rar ============================================================================= ============================================================================= -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (MingW32) iQIcBAEBAgAGBQJPllNzAAoJEJlK/ai8vywmNcQQALVZzxXPZOLM8ghXeFoIZk1Y zumWMQdE4TLQcwg2WNUcGzSvTLss/xMHdBDsHlzXslTBKYwN2W8BBCD0H8MLnhuE 3Vei9nokJDAy6ZKYL8rOeIcuknHIDwf4fjsejDnH1LDdPlKooB+4tYkpGbUcff96 RD4plKA/Olp4SlNPT2U3cEK940ahf6G9W2LGunWgB6jsydudAWUzgVG+sLI+kOmK QAEe6aHsBVzR8zPHJzggkescICcQVxHdg/ppYxRr5lzeyEYUkHS+aY4k3Mr5U2My E0l5QMCozoeSQPujW6U3U91TqkXpjViSuoaY+1v6shxyQbSvtHd6946YUMl7qMCI xzAeofga7JCErH1lltVbUKUnoy6fmbd5F9x2TRIVUSdtoPEFgiHBi0HCRHimx/XS Cxs/LDRyvM0oAYfbiEqRFm/bkoBxScMVQmXq+ZxRFYfihpU/U2jCfY3yk1E4UAsy 0PL0DVUtvt2Fro09pobXkYlVbRjH4BJwu9/Y4Ko/ZMqWFLDmGGEQiDtRB60n3oNm k2CmmsVWTmYpIJ6Rlt3azIYRGCqRGALiB9Eph7WcZnij6y4PwSsNpf6uMZH864EM J3QTi2Xhn+zEq4XEU7IHRRrFyJQOF+0TUV+qYMR+NuBmPhWXk27n6AXQJbu+RjAm 8dBjL95Ghi8s0VQt4rjb =3c+B -----END PGP SIGNATURE----- |