Executive brief
Visual Ping, a network utility used for monitoring host connectivity, is vulnerable to a local buffer overflow. An attacker with access to the system can cause the application to crash by entering excessively long text into various input fields. This results in a denial-of-service condition, preventing the software from performing its intended network monitoring tasks.
Technical details
A classic buffer overflow (CWE-120) exists in Visual Ping version 0.8.0.0 due to insufficient validation of input string lengths. The vulnerability is located in the handling of several input fields, including Host, Time Out, Packet Size, Pause, and Loops. A local attacker can trigger the flaw by supplying a payload exceeding 4108 bytes into any of these fields and initiating a ping operation. This causes the application to crash, resulting in a denial of service. While the primary impact is availability, the nature of the overflow suggests potential for further exploitation depending on memory protections in place on the host OS.
Affected products
- ITLights Visual Ping 0.8.0.0
Timeline
- 2018-08-30: disclosed: Initial discovery by researcher
- 2018-09-03: other: Exploit-DB PoC published
- 2026-05-25: advisory: NVD/VulnCheck advisory published