Executive brief
Arm Whois is a networking utility used to retrieve registration and ownership information for IP addresses and domain names. A security flaw in version 3.11 allows an attacker to take complete control of the system by providing a specially crafted, oversized domain or IP address. This could lead to unauthorized access to sensitive data, system-wide compromise, or the installation of malicious software.
Technical details
A stack-based buffer overflow exists in Arm Whois 3.11 within the processing of the IP address and domain input fields. The vulnerability is triggered when the application receives input exceeding 658 bytes, which allows an attacker to overwrite the Structured Exception Handler (SEH). By crafting a malicious payload containing shellcode and redirecting execution through the overwritten SEH, a remote attacker can achieve arbitrary command execution on the underlying Windows x86 host. While the attack vector is listed as network-reachable, exploitation typically involves a user pasting or the application processing a malicious string. No patch is currently documented in the advisory.
Affected products
- ArmCode Whois 3.11
Timeline
- 2018-11-05: other: Initial exploit code developed
- 2018-11-06: disclosed: Exploit published on Exploit-DB
- 2026-06-01: advisory: CVE published and NVD record created