CVE-2011-3494
eSignal < 10.6.2425 - Stack-Based and Heap-Based Buffer Overflow via Long StyleTemplate or FaceName Field
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2011-3494.
PoCs published by Metasploit, Luigi Auriemma, including Metasploit module exploits/windows/fileformat/esignal_styletemplate_bof.
AI-analyzed exploit summary This exploit targets a buffer overflow vulnerability in eSignal and eSignal Pro <= 10.6.2425.1208 by crafting a malicious .QUO file with an oversized StyleTemplate tag. It uses an egghunter to locate and execute the payload, achieving remote code execution.
Description
WinSig.exe in eSignal 10.6.2425 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via (1) a long StyleTemplate element in a QUO, SUM or POR file, which triggers a stack-based buffer overflow, or (2) a long Font->FaceName field (aka FaceName element), which triggers a heap-based buffer overflow. NOTE: some of these details are obtained from third party information.
Exploits (3)
This exploit targets a buffer overflow vulnerability in eSignal and eSignal Pro <= 10.6.2425.1208 by crafting a malicious .QUO file with an oversized StyleTemplate tag. It uses an egghunter to locate and execute the payload, achieving remote code execution.
The writeup describes two vulnerabilities in eSignal and eSignal Pro (versions <= 10.6.2425.1208): a code execution flaw via malformed '<StyleTemplate>' files (QUO, SUM, POR extensions) and a heap overflow in the Font->FaceName field of ETS, ETQ, and ESK files. No exploit code is provided, only a link to a PoC archive.
This Metasploit module exploits a buffer overflow vulnerability in eSignal and eSignal Pro via malformed QUO files. It uses an egghunter to locate and execute a payload, targeting versions 10.6.2425.1208 and earlier.