Executive brief
Arm Whois is a networking utility used to look up information about domain owners and IP addresses. A security flaw in version 3.11 allows a local attacker to take full control of a computer by providing a specially crafted input file. This could lead to unauthorized software installation, data theft, or a complete system compromise.
Technical details
A classic buffer overflow (CWE-120) exists in Arm Whois 3.11 due to insufficient input validation when processing files. By crafting a malicious input file with a specific 672-byte offset, a local attacker can overwrite the Next Structured Exception Handler (nSEH) and Structured Exception Handler (SEH) pointers. This allows for exception handler hijacking to bypass protections like ASLR and execute arbitrary shellcode. The vulnerability was demonstrated on Windows x86 platforms using an egghunter technique to locate and execute the primary payload.
Affected products
- ArmCode Whois 3.11
Timeline
- 2018-11-23: disclosed: Initial exploit code authored by zephyr
- 2018-11-26: other: Exploit published to Exploit-DB
- 2026-06-01: advisory: CVE published and enriched by VulnCheck