This Metasploit module exploits a stack overflow in Intel Alert Originator Service msgsys.exe. When an attacker sends a specially crafted alert, arbitrary code may be executed.
e22ad9c3efc77c7533de5436789e2a9df15de08dbf91c2f1d16c2a8ae80e4b3fZero Day Initiative Advisory 09-018 - This vulnerability allows attackers to execute arbitrary code on vulnerable installations of Symantec Client Security. Authentication is not required to exploit this vulnerability. The specific flaw resides in the Alert Originator service, iao.exe, which listens by default on TCP port 38292. The process blindly copies user-supplied data to a stack buffer via a memcpy call. By supplying a specially crafted packet, an attacker can overflow that buffer leading to arbitrary code execution in the context of the SYSTEM user.
6f2c6687de793a723fbc5c545b300bc7b6825f1d425a73288eeb566dd22d8ff4
© 2024 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed