Forest Global Training Partners

Cyber Risks · Cisco Talos

VRT-2013-1001 (CVE-2013-6487): Buffer overflow in Gadu-Gadu HTTP parsing

Summary: Cisco Talos describes a buffer overflow in Gadu-Gadu's HTTP parsing where a Content-length header is read with atoi into an unsigned body_size field, so a negative value becomes a large positive number and the check for a value of zero or less never triggers. A body_size of 4294967295 (or -1) causes malloc(0), after which the client memcpy's the response body into the undersized heap buffer and later frees the original chunk.

Why it matters: The flaw turns a single crafted Content-length header into an out-of-bounds heap write in the client, and the unsigned-integer check that was meant to guard it can never be true.

Read the original at Cisco Talos ↗

Topics
Malware
Mentions
CVE-2013-6487
Related