OSSP iSelect Buffer Overflow Vulnerability Allowing Arbitrary Code Execution

A local buffer overflow vulnerability has been identified in OSSP iSelect version 1.4.0-2+b1. This vulnerability allows local attackers to execute arbitrary code by providing an oversized value to the -k or --key parameter. The exploitation involves crafting a malicious argument that includes a NOP sled, shellcode, and a return address, which overflows a 1024-byte stack buffer. As a result, attackers can gain code execution with user privileges.

Impact

Exploitation of this vulnerability leads to a local buffer overflow, allowing for arbitrary code execution with user privileges.

Reproduction

The vulnerability can be reproduced by using the iSelect tool and supplying an oversized value through the -k or --key parameter. The input must be crafted to include a NOP sled, shellcode, and a return address to successfully overflow the buffer and execute the injected code.