Vulnerability: mIRC $asctime overflow

mIRC provides scripting capabilities to allow extension of the client. A flaw exists in the $asctime identifier, which is used to format Unix style time stamps. Passing a string of sufficient length to $asctime will cause a buffer overflow on the stack. This allows the execution of byte code through calling $asctime with a carefully constructed string.


The default script included with mIRC does not call $asctime at any point. However the majority of major scripts available for download call $asctime to decode data provided by the irc server. Many scripts call $asctime on data provided from other remote sources. The exploitation of this flaw therefore depends on the script installed by the victim.

Researched by: James Martin
Full advisory: http://www.uuuppz.com/research/adv-002-mirc.htm
Exploit: Proof of concept code available at above URL.

Product: mIRC
Website: http://www.mirc.com
Version: V6.00, V6.01, V6.02.
Fix: Download mIRC 6.03 from http://www.mirc.com
Please do not download from unofficial sites, as you may
download
a trojaned version.
Type: Buffer Overrun
Risk: Low to High

Source: http://www.xatrix.org/article1882.html