The Bat! 2.01 memory corruption

2004-01-16T00:00:00
ID SECURITYVULNS:DOC:5635
Type securityvulns
Reporter Securityvulns
Modified 2004-01-16T00:00:00

Description

Dear bugtraq,

AGK (agk at sandy.ru) discovered The Bat! 2.01 to throw exception on few messages. It looks like The Bat! 2.01 in standard configuration (with build-in PGP support) has a bug with processing PGP signed messages (protocol="application/pgp-signature") with multiple recursively included parts. I did not any debugging and problem may be in something else, but changing layout of parts and signatures makes The Bat! to read and write different unallocated memory regions, potentially it may be exploitable to code execution. Because The Bat! has it's own exception handler, application does not crashes.

Vendor (RitLabs) was contacted and replied he was unable to reproduce this bug in 2.03 Beta and latest release 2.02 CE is probably not vulnerable to. I did not any validation.

Example of message attached.

-- http://www.security.nnov.ru /\_/\ { , . } |\ +--oQQo->{ ^ }<-----+ \ | ZARAZA U 3APA3A } You know my name - look up my number (The Beatles) +-------------o66o--+ / |/