BeyondCHM 1.1 Buffer Overflow

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

=============================================================================
=============================================================================
 BeyondCHM 1.1 Buffer Overflow (price 32.56 EUR)
 Url: http://www.beyondchm.com/

 Author: shinnai
 mail:   shinnai[at]autistici[dot]org
 site:   http://shinnai.altervista.org/

 This was written for educational purpose. Use it at your own risk.
 Author will be not responsible for any damage.

 Tested on:
 Microsoft Windows 7 Professional
 6.1.7601 Service Pack 1 build 7601

 Info (http://www.beyondchm.com/):
 Beyond CHM is a powerful chm reader and chm editor, It enables user to
 open multiple tabs at the same time. With this CHM viewer, user can edit
 CHM files, including highlighting CHM text, changing font and font size,
 removing contents, adding comments and so on, all the changes can be saved
 persistently. Additionally, user can switch Beyond CHM between reader
 mode and editor mode easily. In reader mode, users can zoom on CHM pages
 and navigate among CHM pages easily. Beyond CHM is a good Microsoft HTML
 Help Tool replacement, which supports nearly all Windows operation systems.
 
 PoC released as is, I have no time at the moment for further investigations
 
=============================================================================
=============================================================================

 Crafting a .chm file is possible to cause a stack based buffer overflow.

 PoC: http://shinnai.altervista.org/exploits/chm.rar
      http://www.exploit-db.com/sploits/18776.rar

=============================================================================
=============================================================================

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (MingW32)

iQIcBAEBAgAGBQJPllNzAAoJEJlK/ai8vywmNcQQALVZzxXPZOLM8ghXeFoIZk1Y
zumWMQdE4TLQcwg2WNUcGzSvTLss/xMHdBDsHlzXslTBKYwN2W8BBCD0H8MLnhuE
3Vei9nokJDAy6ZKYL8rOeIcuknHIDwf4fjsejDnH1LDdPlKooB+4tYkpGbUcff96
RD4plKA/Olp4SlNPT2U3cEK940ahf6G9W2LGunWgB6jsydudAWUzgVG+sLI+kOmK
QAEe6aHsBVzR8zPHJzggkescICcQVxHdg/ppYxRr5lzeyEYUkHS+aY4k3Mr5U2My
E0l5QMCozoeSQPujW6U3U91TqkXpjViSuoaY+1v6shxyQbSvtHd6946YUMl7qMCI
xzAeofga7JCErH1lltVbUKUnoy6fmbd5F9x2TRIVUSdtoPEFgiHBi0HCRHimx/XS
Cxs/LDRyvM0oAYfbiEqRFm/bkoBxScMVQmXq+ZxRFYfihpU/U2jCfY3yk1E4UAsy
0PL0DVUtvt2Fro09pobXkYlVbRjH4BJwu9/Y4Ko/ZMqWFLDmGGEQiDtRB60n3oNm
k2CmmsVWTmYpIJ6Rlt3azIYRGCqRGALiB9Eph7WcZnij6y4PwSsNpf6uMZH864EM
J3QTi2Xhn+zEq4XEU7IHRRrFyJQOF+0TUV+qYMR+NuBmPhWXk27n6AXQJbu+RjAm
8dBjL95Ghi8s0VQt4rjb
=3c+B
-----END PGP SIGNATURE-----