Qualisys C++ SDK Heap Buffer Overflow Vulnerability in XML Text Escaping Component Allowing Denial-of-Service

A heap buffer overflow vulnerability has been identified in the XML Text Escaping component of Qualisys C++ SDK, specifically in commit a32a21a. This vulnerability allows attackers to cause a denial-of-service (DoS) by escaping special XML characters. The issue arises in the 'CMarkup::x_TextToDoc' function, which improperly manages buffer sizes when copying escape sequences, leading to memory corruption and potential crashes.

Impact

Exploitation of this vulnerability causes a heap buffer overflow, leading to memory corruption, a crash, and potential arbitrary code execution.

Reproduction

The vulnerability can be reproduced by using a crafted input that includes special XML characters that need to be escaped. This input should be processed by the 'CMarkup::x_TextToDoc' function, which will trigger the buffer overflow by overwriting memory beyond the allocated buffer size. This can be done using a fuzzer, such as AFL++, targeting the XML escaping functionality.

Remediation

The vulnerability has been fixed in a subsequent commit. Users should update to the latest version of the Qualisys C++ SDK.