Echo Mirage Stack Buffer Overflow Vulnerability Allowing Code Execution

A stack buffer overflow vulnerability has been identified in Echo Mirage version 3.1. This vulnerability allows local attackers to crash the application or execute arbitrary code by sending an oversized string through the Rules action field. Exploitation involves creating a malicious text file with a payload that exceeds buffer limits, which can then be pasted into the action field via the Rules dialog. This triggers the buffer overflow by overwriting the return address.

Impact

Exploitation of this vulnerability leads to a stack-based buffer overflow, allowing for application crashes or arbitrary code execution.

Reproduction

To reproduce this vulnerability, open Echo Mirage 3.1 and navigate to the 'Rules' section. Click on 'New' to create a new rule. Then, copy the contents of a prepared text file that exceeds the buffer limit and paste it into the 'action' field. This will trigger the buffer overflow by overwriting the return address.