Kazaa patcht kritieke bug in netwerk

Geldt dit ook voor kazaa lite?

Vulnerability Information
-------------------------
Packet 0 (possibly called "KAZAA_CONNECTION_INFO", but
from here on called "Packet 0' death", note the zero)
is used to send up to 200 supernode IPs to clients and
supernodes. The supernodes' packet 0' death handler
(possibly class "supernode_connection_t") is different
from the other packet 0' death handlers, and it also
contains the buffer overflow bug. The supernode packet
0' death handler assumes only 200 supernode entries
can be received, but if you send more you can
overwrite the return address and more of the stack.

The size of the packet must be a multiple of 8 bytes
or the whole packet is ignored, and since max packet
size is 65535 bytes, a total of 8191 supernode entries
can be sent. Of these 8-byte entries, only the first 6
bytes are stored on the stack. This means that you can
send 49146 bytes of code to each supernode. If more is
required the code could download the rest manually.
Format of each entry:

DWORD = Supernode IP in network order.
WORD = Supernode port in network order.
BYTE = Can't be used by attacker's code. Set it to 0.
BYTE = Can't be used by attacker's code. Set it to 0.

The IP and port fields are later BSWAP'd by the FT
code.

The IP cannot be a private IP address. Kazaa v2.0.2
considers these IP ranges to be private and ignores
all packet entries with private IPs:

* 127.b.c.d
* 10.b.c.d
* 0.b.c.d
* 172.16.0.0 - 172.31.255.255
* 192.168.c.d
* 255.255.255.255

Also, the supernode port cannot equal 0000h. Kazaa
ignores all entries whose port equals 0.

I tested executing code a couple of times, and it may
only work about 50% of the time since the stack
sometimes has another address. Instead of executing
code the supernode will just crash.

Since executing code doesn't work all the time, a
possible exploit could first download all supernode
IPs and ports from the supernode. Then send the packet
0' death and try to execute code. If the infected
supernode doesn't reply back within say 30 secs, we
can assume it crashed. If it didn't crash, ignore all
supernode IPs we downloaded and let the infected
supernode use them. Now try next supernode. When no
more left, call ExitProcess.

With Kazaa v2.0.2, all that is required to crash the
supernode is to send 203 entries. Example: Send packet
0' death, 203 entries all equal to: 0FFFFFFFEh,
0FFFFFFFFh.

Discovery
---------
I discovered this vulnerability either in Dec 2002 or
Jan 2003 when writing K++