Faleemi Desktop Software Buffer Overflow Vulnerability Allowing Code Execution

A local buffer overflow vulnerability has been identified in Faleemi Desktop Software version 1.8. The issue arises in the System Setup dialog, where attackers can exploit structured exception handling to bypass Data Execution Prevention (DEP) protections. By injecting a crafted payload into the 'Save Path for Snapshot and Record file' field, an attacker can trigger the buffer overflow and execute arbitrary code using Return-Oriented Programming (ROP) chain gadgets.

Impact

Exploitation of this vulnerability leads to a buffer overflow, allowing for arbitrary code execution on the affected system.

Reproduction

To reproduce this vulnerability, open the Faleemi Desktop Software and navigate to the 'System Setup' dialog. Inject a payload into the 'Save Path for Snapshot and Record file' field. When the 'Save' button is clicked, the injected payload will cause a buffer overflow, which can be exploited to execute arbitrary code.