[Owasp-dotnet] Heap Overrun exploitation

3 shool 3shool at gmail.com
Thu Aug 31 17:23:01 EDT 2006


Hello Group,

This is my first email here.

I am doing pen test for a desktop application written in C#. While
doing runtime analysis of the exe and some important DLLs of the
application, as user ADMINISTRATOR, I found a number of Heap Overruns
in the COM (unmanaged) components used by the application.

Now the scenario is that the C# application runs with privileges of
the user logged-in (low privilege user) and not like a service or
SYSTEM account so is it possible to do the
following:

1. Obtain the same Heap Overruns from any LOW privileged user. Even if
it was possible would the attacker gain any extra privilege as the
application is running as the LOW privileged user.

2. Can these attacks be sent over the network when the application
communicates with the Internet services?

3. Any other attacks that are possible here?

Thnx.




More information about the Owasp-dotnet mailing list