##########################################################################
Application: MSN Messenger 6.0
http://www.msnmessenger-download.com/Preview/
Affected Versions: MSN Messenger 6.0 biuld 6.0.0501 and prior
Bug: Buffer overflow in msnmsgr.exe
(In the small viewer box that show the sending file
before accepting it).
Author: Bahaa Naamneh
e-mail: b_naamneh@hotmail.com
##########################################################################
=============
Introduction:
=============
MSN Messenger is one of the most famous messengers, due to the interesting
services that it offer.
the version 6.0 appear with many services, one of this services is
the small viewer box that show the icon of the sending file before getting
it,if the sending file
is picture this box show the picture itself not the icon before getting it.
picture of the viewer box
(http://members.lycos.co.uk/bnsecurity/msn/msn01.JPG)
==========================
The bug (buffer overflow):
==========================
Sending "uncompleted pictures" cause a buffer overflow.
"Uncompleted pictures": I don't know if this phrase is correct, anyway
I mean by this phrase the pictures that we didn't received it completely.
Sometimes while we receiving picture from any person the connection failed
or something happen that cause of nonbeing receiving the whole pictures
but although that we still can open it but it appear two parts the first
part is the receiving part and the second part appear with dark color.
picture of "Uncompleted pictures":
(http://members.lycos.co.uk/bnsecurity/msn/msn03.JPG).
You can download "uncompleted picture" from this link.
http://members.lycos.co.uk/bnsecurity/01/
(disable any downloading programs like getright or DAP ... if u use)
when u send "uncompleted picture" via messenger 6.0 the small viewer will
lose the default size that it programmed to be.
http://members.lycos.co.uk/bnsecurity/msn/msn03.JPG
So sending the "uncompleted picture" will cause of Buffer overflow and
Messenger will crash.
http://members.lycos.co.uk/bnsecurity/msn/msn04.JPG
=================
Vendor Response:
=================
Contacted. The bug have already fixed in build 6.0.0602
Microsoft Response: "...We suspect that we have already fixed this bug as
early as build 501 as
your report is very similar to a bug that was resolved with that build?but
we would like your
assistance to verify this. ..."
========
Exploit:
========
I'm trying to make an exploit in "visual basic"!!!.
You can download the "uncompleted picture" from this link:
http://members.lycos.co.uk/bnsecurity/01/
and test it by sending it via the messenger 6.0
##########################################################################
..Sorry for my poor english
