CVE-2020-7837— Infraware Polaris ML Report Program 缓冲区错误漏洞

N/A

An issue was discovered in ML Report Program. There is a stack-based buffer overflow in function sub_41EAF0 at MLReportDeamon.exe. The function will call vsprintf without checking the length of strings in parameters given by attacker. And it finally leads to a stack-based buffer overflow via access to crafted web page. This issue affects: Infraware ML Report 2.19.312.0000.

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

栈缓冲区溢出

Infraware Polaris ML Report Program 缓冲区错误漏洞

Infraware Polaris ML Report是韩国Infraware公司的一款基于Web浏览器可实现兼容性打印报告的Web软件。 ML Report Program 存在安全漏洞，该漏洞源于在mlreportdeam .exe的sub_41EAF0函数中有一个基于堆栈的缓冲区溢出。该函数将调用vsprintf，而不检查攻击者可利用该漏洞提供的参数中的字符串长度。通过访问精心制作的网页，最终导致基于堆栈的缓冲区溢出。

N/A

N/A