[prev in list] [next in list] [prev in thread] [next in thread] 

List:       bugtraq
Subject:    WorldFlash - Spyware and BO
From:       mac.ac () t-online ! de (Dr !  Markus a Campo)
Date:       2003-08-28 15:36:15
[Download RAW message or body]

I use the demo-version of the WorldFlash News-Ticker Gold M5.30i
(http://www.worldflash.com/). While investigating some unexpected crashs
of the programm with a sniffer, I noticed that some privat informations
are sent back to WorldFlash, i.e. my real IP behind the firewall, the
mailserver I use, and other stuff (see attachment).

When I contacted the vendor I was told to uninstall the program - YES
SIR, I WILL DO SO

The crash seems to be a buffer overrun while getting news. Some sites
send back a whole bunch of useless HTML-crap back to the ticker.

Best regards

Markus a Campo



["wordflash.txt" (text/plain)]

POST /cgi-bin/admin5.exe HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Content-Length: 221
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; WFG)
Host: www.scroller.com
Connection: Keep-Alive
Cache-Control: no-cache

192.168.69.35&mac.ac/mailto.btx.dtag.de@127.0.0.1&1399765272&1061960668&a06bdb1&jupite \
r&00000000000000000040802000800000&4294963696&24c0a81a&00000000000000000000401000000000&6f10000&1300051




‡%2-!.9f„…f(5'/€4m/.,).%n$%
HTTP/1.1 200 OK
Date: Wed, 27 Aug 2003 04:38:25 GMT
Server: Apache/1.3.26 (Unix) PHP/4.1.2
Keep-Alive: timeout=3, max=5
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html

31 
This is text sent back to the WorldFlash client


0

HEAD /Service1.dll HTTP/1.1
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; WFG)
Host: www.scroller.com
Content-Length: 0
Connection: Keep-Alive
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Wed, 27 Aug 2003 04:38:25 GMT
Server: Apache/1.3.26 (Unix) PHP/4.1.2
Last-Modified: Sun, 24 Aug 2003 02:48:18 GMT
ETag: "2733b1-24600-3f482772"
Accept-Ranges: bytes
Content-Length: 148992
Keep-Alive: timeout=3, max=4
Connection: Keep-Alive
Content-Type: text/plain



[prev in list] [next in list] [prev in thread] [next in thread]