Visit our newest sister site!
Hundreds of free aircraft flight manuals
Civilian • Historical • Military • Declassified • FREE!

TUCoPS :: Windows Net Apps :: bt260.txt

Eudora 5.2.1 buffer overflow DoS

Building on my Eudora attachment spoof

I notice that sending a filename with many dots crashes Eudora, e.g.

  From: me
  To: you
  Attachment Converted<CR>: "\B.A.A.A ... .A.A.A"

(with 122 repetitions of ".A") make it crash, writing an Exception.log
file. (Fewer repetitions cause no problem; more cause Eudora to crash,
without even an Exception.log.)

Eudora is then unable to start, until the offending message is removed from
In.mbx (using some utility other than Eudora itself).

I do not know if this buffer overflow is exploitable: Exception.log says

Exception code: c0000005 ACCESS_VIOLATION
Fault address:  77e873bc 01:000063bc C:\WINNT\system32\KERNEL32.DLL

(only ECX seems controllable).

(Tested with Eudora 5.2.1 on Windows 2000.)


Paul Szabo -
School of Mathematics and Statistics  University of Sydney   2006  Australia

TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2015 AOH