Executive brief
Atomic Alarm Clock is a desktop application used to customize the Windows system tray clock and manage alarms. A security flaw allows a local user to take full control of the application by entering an excessively long, specially crafted text string into the 'display name' field within the Time Zones configuration. This could lead to the execution of unauthorized commands or malicious software on the user's computer with the same permissions as the application.
Technical details
A stack-based buffer overflow (CWE-121) exists in Atomic Alarm Clock version 6.3. The vulnerability is triggered when a user inputs a malicious Unicode string into the 'display name' textbox within the Time Zones Clock configuration menu. An attacker can exploit this by crafting a payload that overwrites the Structured Exception Handler (SEH) and utilizes encoded shellcode to bypass SafeSEH protections. Successful exploitation allows for arbitrary code execution with the privileges of the application. While the attack vector is local, it does not require elevated privileges or specific user interaction beyond the input of the malicious string.
Affected products
- Drive Software Company Atomic Alarm Clock 6.3 and earlier
Timeline
- 2020-04-17: other: Vulnerability discovered and exploit developed by researcher
- 2020-04-20: disclosed: Exploit published on Exploit-DB
- 2026-05-13: advisory: NVD/VulnCheck advisory published