CVE-2009-2286
compface < 1.5.2 - Buffer Overflow via Long Declaration in .xbm File
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2009-2286. PoCs published by His0k4, metalhoney.
AI-analyzed exploit summary This exploit targets a local buffer overflow in compface 1.1.5 by crafting a malicious .xbm file. It uses a setuid/execve shellcode to achieve remote code execution when the file is processed by the vulnerable software.
Description
Buffer overflow in compface 1.5.2 and earlier allows user-assisted attackers to cause a denial of service (crash) via a long declaration in a .xbm file. NOTE: this issue only affects compface on distributions that used a certain patch.
Exploits (2)
This exploit targets a local buffer overflow in compface 1.1.5 by crafting a malicious .xbm file. It uses a setuid/execve shellcode to achieve remote code execution when the file is processed by the vulnerable software.
This exploit generates a malformed XBM file with a buffer overflow payload to trigger a vulnerability in compface <= 1.5.2. The PoC creates an oversized buffer (184 'A' characters) to demonstrate the overflow condition.