HTTP: mIRC IRC URI Handler Buffer Overflow

This signature detects attempts to exploit a known vulnerability against the mIRC IRC client URI handler plugin. Attackers can supply a malicious crafted hostname, which can cause a buffer overflow and allow them to execute arbitrary code on the client.

Extended Description

When mIRC is installed it registers a handler for a 'irc://' type of URL. Through these means, mIRC is invoked when an 'IRC URL' is followed. mIRC has been reported prone to a buffer overflow vulnerability when handling malicious 'IRC URLs'. The issue likely presents itself due to a lack of sufficient boundary checks performed when IRC URL data is being copied into an insufficient buffer in memory. Ultimately a remote attacker may exploit this condition to execute arbitrary instructions in the context of the user running the affected client.

Affected Products

Khaled_mardam-bey mirc

References

BugTraq: 8819

URL: http://www.mirc.com/index.html

Short Name

HTTP:STC:MIRC-URI-OF

Severity

Major

Recommended

False

Recommended Action

Drop

HTTP: mIRC IRC URI Handler Buffer Overflow

Extended Description

Affected Products

References

Found a potential security threat?