The Bat! 2.01 memory corruption

Type securityvulns
Reporter Securityvulns
Modified 2004-01-16T00:00:00


Dear bugtraq,

AGK (agk at discovered The Bat! 2.01 to throw exception on few messages. It looks like The Bat! 2.01 in standard configuration (with build-in PGP support) has a bug with processing PGP signed messages (protocol="application/pgp-signature") with multiple recursively included parts. I did not any debugging and problem may be in something else, but changing layout of parts and signatures makes The Bat! to read and write different unallocated memory regions, potentially it may be exploitable to code execution. Because The Bat! has it's own exception handler, application does not crashes.

Vendor (RitLabs) was contacted and replied he was unable to reproduce this bug in 2.03 Beta and latest release 2.02 CE is probably not vulnerable to. I did not any validation.

Example of message attached.

-- /\_/\ { , . } |\ +--oQQo->{ ^ }<-----+ \ | ZARAZA U 3APA3A } You know my name - look up my number (The Beatles) +-------------o66o--+ / |/