Executive brief
IP TOOLS is a suite of network diagnostic utilities used by administrators to manage and monitor network connections. A vulnerability in the SNMP Scanner component allows a local user to crash the application by entering excessively long text into specific address fields. This results in a denial-of-service condition where the tool becomes unresponsive or closes unexpectedly, potentially disrupting network troubleshooting activities.
Technical details
A local buffer overflow vulnerability exists in the SNMP Scanner component of Ks-Soft IP TOOLS version 2.50. The flaw is triggered when an attacker provides oversized input (approximately 4112 bytes or more) into the 'From Addr' or 'To Addr' input fields. This results in an out-of-bounds write (CWE-787) that leads to a crash of the application and an overwrite of the Structured Exception Handler (SEH) chain. While the primary impact is denial of service, SEH overwrites are often a precursor to arbitrary code execution. Exploitation requires local access to the application and manual user interaction to paste the malicious string and initiate the scan.
Affected products
- Ks-Soft IP TOOLS 2.50
Timeline
- 2018-12-20: disclosed: Vulnerability discovered by Rafael Pedrero
- 2019-01-30: other: Proof of concept exploit published on Exploit-DB
- 2026-04-05: advisory: CVE published/assigned via VulnCheck