Dear bugtraq, AGK (agk at sandy.ru) discovered The Bat! 2.01 to throw exception on few messages. It looks like The Bat! 2.01 in standard configuration (with build-in PGP support) has a bug with processing PGP signed messages (protocol="application/pgp-signature") with multiple recursively included parts. I did not any debugging and problem may be in something else, but changing layout of parts and signatures makes The Bat! to read _and write_ different unallocated memory regions, potentially it may be exploitable to code execution. Because The Bat! has it's own exception handler, application does not crash. Vendor (RitLabs) was contacted and replied he was unable to reproduce this bug in 2.03 Beta and latest release 2.02 CE is _probably_ not vulnerable to. I did not any validation. 1.x versions are not vulnerable. Example of message attached. -- http://www.security.nnov.ru /\_/\ { , . } |\ +--oQQo->{ ^ }<-----+ \ | ZARAZA U 3APA3A } You know my name - look up my number (The Beatles) +-------------o66o--+ / |/
--- Begin Message -----
- To: "Test"
- From: "Test"
- Date: 31 Dec 2003 23:42:47 +0300
- Organization:
Test--- Begin Message ---
- To: Test
- Subject: Test2
- From: Test
- Date: Sat, 27 Dec 2003 10:18:57 +0300 (MSK)
TestReporting-MTA: dns; test Arrival-Date: Sat, 27 Dec 2003 10:18:53 -0800 (PST) Test
--- End Message ---Attachment: signature.asc
Description: This is a digitally signed message part
--- End Message ---
