Executive brief
Foundstone NetSchedScan, a network utility tool, is vulnerable to a local buffer overflow. An attacker with access to the system can cause the application to crash by entering an excessively long string into the Hostname/IP field. This results in a denial of service, preventing legitimate use of the software.
Technical details
A stack-based buffer overflow (CWE-787) exists in NetSchedScan 1.0 within the 'Hostname/IP' input field. The vulnerability is triggered when a local user provides a specially crafted string exceeding 388 bytes, which leads to an overwrite of the EIP (Instruction Pointer) register. While the primary reported impact is a denial of service (application crash), the ability to overwrite the EIP suggests potential for arbitrary code execution, though only a DoS PoC is currently verified. The attack requires local access to the application's interface to paste the payload. No patch is currently documented for this legacy tool.
Affected products
- Foundstone NetSchedScan 1.0
Timeline
- 2016-01-14: disclosed: Vulnerability discovered by Abraham Espinosa
- 2016-01-15: other: Proof of concept exploit published to Exploit-DB
- 2026-04-04: advisory: NVD/VulnCheck advisory published