TIATunnel Authentication Mechanism Buffer Overflow Vulnerability

TIAtunnel is a freely available IRC session bouncing software package. It is distributed by the pkcrew.

A problem in the software package makes it possible for a remote user to gain a local shell. Due to a buffer overflow in the authentication mechanism of TIAtunnel, it is possible for a remote user to overwrite variables on the stack, including the return address, and thus gaining a remote shell.

Therefore, it is possible for a remote user to gain a local interactive shell with the permissions of the TIAtunnel process.


 

Privacy Statement
Copyright 2010, SecurityFocus