LibVC - '.VCard' 003 Processing Buffer Overflow

Author: trew
type: dos
platform: multiple
port: 
date_added: 2006-03-21 
date_updated: 2013-08-11 
verified: 1 
codes: CVE-2006-1356;OSVDB-23985 
tags: 
aliases:  
screenshot_url:  
application_url: 

source: https://www.securityfocus.com/bid/17237/info

LibVC is prone to a buffer-overflow vulnerability. This issue is due to a failure in the library to perform proper bounds checks on user-supplied data before using it in a finite-sized buffer.

The issue occurs when the application handles excessive data supplied with a vcard file.

An attacker can exploit this issue to crash the affected library, effectively denying service. Arbitrary code execution is also possible, which may facilitate a compromise of the underlying system.

The following proof of concept is available:

[example file]
BEGIN:VCARD
VERSION:3.0
F:<bunch of a's>
N:;
END:VCARD
[/example file]