ZOC Terminal Denial-of-Service Vulnerability

A denial-of-service vulnerability has been identified in ZOC Terminal version 7.25.5. The issue arises in the private key file input field, where an attacker can overwrite the input with a 2000-byte buffer. This causes the application to become unresponsive when it attempts to create SSH key files.

Impact

Exploitation of this vulnerability leads to a crash of the ZOC Terminal application, causing it to become unresponsive.

Reproduction

To reproduce this vulnerability, first create a text file containing a 2000-byte buffer of repeated characters. After saving this file, open ZOC Terminal and navigate to the 'Create SSH Key Files' option. In the 'Private key file' field, erase the existing content and paste the buffered text from the clipboard. Once the buffer is pasted, click on 'Create public/private key files', which will cause the application to crash.