Title : FeedDemon Buffer OverFlow Vulnerability 1. General Information FeedDemon is known as the most popular Windows RSS Reader which allows users to view and manage easily RSS feeds from their desktop. In January 2009, SVRT-BKIS detected a buffer overflow vulnerability in this software. Taking advantage of this flaw, hackers can perform remote attacks, install viruses, steal private information, and even take control of users' systems. We have sent the alert to the manufacturer. Details : http://security.bkis.vn/?p=329 SVRT Advisory : SVRT-02-09 Initial vendor notification : 01-21-2009 Release Date : 02-05-2009 Update Date : 02-05-2009 Discovered by : Le Nhat Minh (SVRT-Bkis) Security Rating : Critical Impact : Remote Code Execution Affected Software : FeedDemon (version <= 2.7) 2. Technical Description The vulnerability was found in the processing of OPML (Outline Processor Markup Language) file, which is an XML format for outlines used by RSS reader to store and manage RSS feeds. With OPML, users can easily share their RSS feed lists with others or export these lists to use in other RSS feed readers. However, FeedDemon does not handle this format well enough, which leads to buffer overflow flaw. More precisely, the error occurs when users import an OPML file, whose "outline" tag has a too long "text" attribute. FeedDemon, on parsing this file, will crash; and if malicious code is embedded into that file, it will be executed and give hackers system control. Exploitation can be carried out via a file stored on victims' computers or simply a link to such file. It is this factor that increases the threat of users' computers being attack remotely. Taking advantage of the above vulnerability, a hacker might prepare a malicious OPML file, and somehow trick users into importing it. He/she might send the file to users directly or send them a link to that file instead. Right after users have imported the file, malicious code will be executed and they will become hacker's victims. 3. Solution Rating this vulnerability high severity, and due to the fact that the manufacturer hasn't released any official patch for it. Bkis recommends that users of FeedDemon should be careful when importing RSS feed lists from untrustworthy sources. ------------------------------------------------------------------------ ------------------------------------------------ About SVRT-Bkis : SVRT, which is short for Security Vulnerability Research Team, is one of Bkis researching groups. SVRT specializes in the detection, alert and announcement of security vulnerabilities in software, operating systems, network protocols and embedded systems. About Bkis : Bkis is Vietnamese leading Center in researching, deploying network security software and solutions.