Corelan Team

Advisory        : CORELAN-10-049

Disclosure date : May 2, 2010

CVE :

http://www.corelan.be:8800/adv…..LAN-10-049

00 : Vulnerability information

 Product : Power Tab Editor

 Version : 1.7 (Build 80) (latest version)

 Vendor : Power Tab Software Collection

 URL : http://www.power-tab.net/

 Platform : Windows

 Type of vulnerability : Stack buffer overflow

 Risk rating : High

 Issue fixed in version : not fixed

 Vulnerability discovered by : Sud0

 Corelan Team :

 http://www.corelan.be:8800/index.php/security/corelan-team-members/

01 : Vendor description of software

02 : Vulnerability details

A flaw in how the application handles the font name defined in the ptb file which an attacker can utilize in a manner other than the designer intended. This allows the attacker to run arbitrary-code execution on the victims machine when a specially crafted PTB file has been open within the application.

03 : Author/Vendor communication

 May 16th, 2010 : author contacted

 May 24th, 2010  : sent reminder

 June 11th, 2010 : No response, public disclosure

04: Proof of Concept

PoC Exploit