VB Windows Help Buffer Overflow

http://whiteroof.netfirms.com/ChmOverfl...


''''' buffer looks like that
'whatver.chm-Nop-ShellcodeFrst-Nop-ShellCode-Nop-Ebp-Eip
'nop are unimportant
'ShellcodeFrst does : add edi,46
' : jmp edi
'(Shellcode is at EDI)

'ShellCode does : Start up a cmd.exe (not remote) and crash IE
' : taken in a paper from David Litchfield
'
'This proof of concept works with
'Microsoft Windows XP Kernel Version 5.1.2600.0

'Affected software:
' Microsoft Windows 98
' Microsoft Windows 98 Second Edition
' Microsoft Windows Millennium Edition
' Microsoft Windows NT 4.0
' Microsoft Windows NT 4.0, Terminal Server Edition
' Microsoft Windows 2000
' Microsoft Windows XP

'Size of the Buffer depends on the Windows Version
'Based on the Unchecked Buffer in Windows Help.

Proxy nastavite na port katerega uporabljate in sprobajte.
Ce ste ranljivi poiscite Security update za Help buffer overflow