----------------------------------------------------------------------

Hardcore Disassembler / Reverse Engineer Wanted!

Want to work with IDA and BinDiff?
Want to write PoC's and Exploits?

Your nationality is not important.
We will get you a work permit, find an apartment, and offer a
relocation compensation package.

http://secunia.com/hardcore_disassembler_and_reverse_engineer/

----------------------------------------------------------------------

TITLE:
DConnect Daemon Multiple Vulnerabilities

SECUNIA ADVISORY ID:
SA21384

VERIFY ADVISORY:
http://secunia.com/advisories/21384/

CRITICAL:
Highly critical

IMPACT:
DoS, System access

WHERE:
>From remote

SOFTWARE:
DConnect Daemon 0.x
http://secunia.com/product/11246/

DESCRIPTION:
Luigi Auriemma has reported some vulnerabilities in DConnect Daemon,
which can be exploited by malicious people to cause a DoS (Denial of
Service) and potentially compromise a vulnerable system.

1) A boundary error in the "listen_thread_udp()" function in main.c
can be exploited to cause a stack-based buffer overflow by sending a
UDP packet with an overly long nickname to the service.

Successful exploitation may allow execution of arbitrary code, but
requires that the "min_slots" parameter in dcd.conf is enabled.

NOTE: The UDP port is reportedly disabled by default.

2) A NULL pointer dereference error exists in the "dc_chat()"
function in cmd.dc.c when handling client messages. This can be
exploited to crash the service by sending a message before sending
the nickname.

3) Some format string errors exist in various functions due to unsafe
usage of the "privmsg()" and "pubmsg()" functions when sending
messages. This can potentially be exploited to execute arbitrary code
via specially crafted messages.

Successful exploitation of this vulnerability requires superior user
or administrator privileges.

The vulnerabilities have been reported in version 0.7.0. Other
versions may also be affected.

SOLUTION:
The vulnerabilities have been fixed in the CVS repository.

PROVIDED AND/OR DISCOVERED BY:
Luigi Auriemma

ORIGINAL ADVISORY:
http://aluigi.altervista.org/adv/dconnx-adv.txt

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

----------------------------------------------------------------------