Armcode AlienIP Locate Host denial of service

Vulnerability

Armcode AlienIP version 2.41 contains a vulnerability in the Locate Host Handler component. An unknown function is affected by a buffer overflow when processing oversized input. The issue is triggered by manipulating the IP address or Country field with a long string of characters (5005 'A' characters). The vendor was contacted but did not respond [1].

Exploitation

An attacker requires local access to the system running AlienIP 2.41. The exploit involves creating a file (exploit.txt) containing a buffer of 5005 'A' characters, copying its contents to the clipboard, and pasting it into the IP address or Country field. Clicking 'Locate host' and pressing 'Enter' triggers the overflow, causing a denial of service. No authentication or user interaction beyond pasting the malformed input is needed [1].

Impact

Successful exploitation leads to a denial of service condition, likely crashing the application. The impact is limited to local availability; no data confidentiality or integrity compromise is indicated in available references [1].

Mitigation

As of the publication date (2024-02-02), no official patch or workaround has been released. The vendor did not respond to disclosure attempts [1]. Users should limit local access to the system and consider using alternative software until a fix is provided.