Description
Stack-based buffer overflow in Open Direct Connect Hub (aka Open DC Hub or OpenDCHub) 0.8.1 allows remote authenticated users to execute arbitrary code via a long MyINFO message.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- OpenDcHub 0.8.1 - Remote Code Execution EDB-11986 · remote · Mar 31, 2010
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- FEDORA-2010-6415 vendor-advisory
- ADV-2010-1044 vdb-entry
- [oss-security] 20100403 CVE Request -- OpenDCHub v0.8.1 -- Stack overflow by handling a specially-crafted MyINFO message mailing-list
- FEDORA-2010-6478 vendor-advisory
- 39664 third-party-advisory
- 20100331 OpenDcHub 0.8.1 Remote Code Execution Exploit mailing-list
- [oss-security] 20100406 Re: CVE Request -- OpenDCHub v0.8.1 -- Stack overflow by handling a specially-crafted MyINFO message mailing-list
- ADV-2010-1023 vdb-entry
- http://www.indahax.com/exploits/opendchub-0-8-1-remote-code-execution-exploit#more-600
- 39129 vdb-entry
- FEDORA-2010-6426 vendor-advisory
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=576308
- https://bugzilla.redhat.com/show_bug.cgi?id=579206