Baidu Hi IM software parsing plaintext stack overflow -- CVE ID: Not assigned -- Affected Vendors: Baidu -- Affected Products: Baidu Hi IM software -- Vulnerability Details: Our automatic bug exploiting tools have found a buffer overflow bug in Baidu Hi IM software which is a popular IM software in China. This bug is due to Baidu Hi do not strictly check the deciphered plaintext format in CSTransfer.dll. Because of encryption mechanism of Baidu Hi, it is hard to generate the proper malicious packet, but not say it's impossible. A proper malicious packet can cause client system full controlled. -- Vendor Response: I contacted with Baidu a month ago, no any response from Baidu. -- Credit: This vulnerability was discovered by: Gen LI & Jun MA & Ying Zhang More Detail : (CSTransfer.dll) esi +---------------------+ | | | \|/ | Malicious input | _______________________________ | ...........> | | | | | | | | | +---------------------+ |R | |4 |0 | |\r |\n | .... | |__|__|__|__|__|___|___|_______| /|\ | ebp +---------------------+ | | | Correct content | ______________________________________________________ | ...........> | | | | | | | | | | | | | | | | +---------------------+ | c| m | | 1| . |0 | |R | |4 |0 | |\r |\n | .... | loc_10007880: |__|___|_|__|___|__|___|__|__|__|__|__|___|___|_______| mov al, [esi-1] /|\ /|\ dec esi | | cmp al, 20h ebp esi jnz short loc_10007890 | +-------+ |---------------------. | | | | | \|/ \|/ | | loc_10007888: | | mov al, [esi-1] | | dec esi | | cmp al, 20h | | jz short loc_10007888 | | | | | |-----------+ | +----------------| | | \|/ \|/ loc_10007890: push 20h esi edi push ebp +---------------------+ | | inc esi | | \|/ \|/ call ds:strchr | Malicious input | ____________ _______________________________ mov edi, eax ---------> | ...>| | | | | | | | | | +---------------------+ |heap struct |R | |4 |0 | |\r |\n | .... | ........... |____________|__|__|__|__|__|___|___|_______| /|\ loc_100078EA: | sub esi, edi ;esi will be a negative number ebp cmp esi, 1Eh jg loc_100079FD push esi ; size_t ;esi will be a negative number lea edx, [esp+44h+var_24] push edi ; char * push edx ; char * call ds:strncpy ; cause buffer overflow