Forest Global Training Partners

Cyber Risks · Cisco Talos

VRT-2013-1002 (CVE-2013-6489): Buffer overflow in MXit emoticon parsing

Summary: Cisco Talos documented a buffer overflow in Pidgin 2.10.7's MXit emoticon parsing, where the asn_getUtf8 function reads a one-byte length into a signed integer, so a value of 0xFF is interpreted as -1. The g_malloc call with that length overflows, and because gmalloc returns NULL on a zero-size allocation, the subsequent memcpy becomes a write to the NULL page rather than a typical heap overflow.

What you should know: The write lands on the zero page, which Talos notes is exploitable if an attacker can force enough allocations to exhaust the address range and make the system map the low page - a path that depends on memory pressure rather than a single malformed message.

Read the original at Cisco Talos ↗

Topics
Malware
Mentions
CVE-2013-6489
Related