CVE-2009-20004
HIGHgAlan < 0.2.1 - Stack-based Buffer Overflow via .galan File Parsing
Title source: llmExploitation Summary
EIP tracks 4 public exploits for CVE-2009-20004.
PoCs published by Metasploit, Dz_attacker, Jeremy Brown, including Metasploit module exploits/windows/fileformat/galan_fileformat_bof.
AI-analyzed exploit summary This is a Metasploit module exploiting a stack buffer overflow in gAlan 0.2.1 via a crafted .galan file. It leverages a hardcoded return address (0x100175D0) to execute arbitrary payloads on Windows XP.
Description
gAlan 0.2.1, a modular audio processing environment for Windows, is vulnerable to a stack-based buffer overflow when parsing .galan files. The application fails to properly validate the length of input data, allowing a specially crafted file to overwrite the stack and execute arbitrary code. Exploitation requires local interaction, typically by convincing a user to open the malicious file.
Exploits (4)
This is a Metasploit module exploiting a stack buffer overflow in gAlan 0.2.1 via a crafted .galan file. It leverages a hardcoded return address (0x100175D0) to execute arbitrary payloads on Windows XP.
This is a functional buffer overflow exploit targeting the gAlan software via a crafted .galan file. It leverages a known vulnerability (EIP-2026-140198) to execute arbitrary shellcode, specifically launching calc.exe via a Metasploit-generated payload.
This exploit targets a buffer overflow vulnerability in gAlan (a modular audio processing tool) by overwriting the EIP with a JMP ESP address from user32.dll and executing a shell_bind_tcp payload. The payload is written to a file named 'bof.galan' to trigger the vulnerability.
This Metasploit module exploits a stack buffer overflow in gAlan 0.2.1 by crafting a malicious .galan file. It triggers a buffer overflow via a long string followed by a return address and shellcode to achieve remote code execution.
References (7)
Scores
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N