SEC-1 LTD.
                              www.sec-1.com

                             Security Advisory

Advisory Name:  Cain & Abel PSK Sniffer Heap overflow
 Release Date:  18/03/2005
  Application:   Cain & Abel 2.65

  Platform:   Win32
  Severity:   Remote Code Execution
  Author:  Gary O'leary-Steele

Vendor Status:   Fixed 16/03/2005
CVE Candidate:   N/A
    Reference:  http://www.oxid.it


Overview:

Cain & Abel is a password recovery tool for Microsoft Operating Systems.
It allows easy recovery of various kind of passwords by sniffing the
network,
cracking encrypted passwords using Dictionary, Brute-Force and Cryptanalysis
attacks,
recording VoIP conversations, decoding scrambled passwords, revealing
password boxes
and analyzing routing protocols.


Details:

Sec-1 has identified a exploitable Heap Overflow within the PSK Sniffer
which could lead to arbitrary code execution.

By sending a large 'ID' parameter within the IKE packet it is possible to
overwrite
critical portions of the heap which could lead to remote code execution or a
denial
of service condition. Sec-1 were able to exploit this vulnerability by
overwriting the
pointer to RtlEnterCriticalSection().

Vendor Response:

Reported 15/03/05 fixed 16/03/05. Extremely fast response!!

Version 2.66 resolves the problem.

Download it at: http://www.oxid.it/cain.html


Common Vulnerabilities and Exposures (CVE) Information:

The Common Vulnerabilities and Exposures (CVE) project has assigned
the following names to these issues.  These are candidates for
inclusion in the CVE list (http://cve.mitre.org), which standardizes
names for security problems.

NOT_YET_CONFIRMED

Copyright 2005 Sec-1 LTD. All rights reserved.


******************************************************************************************************************************************************************
NEW: Sec-1 Hacking Training - Learn to breach network security to further your knowledge and protect your network http://www.sec-1.com/applied_hacking_course.html
******************************************************************************************************************************************************************