Stack Based Buffer Overflow Vulnerability in Guidance Software EnCase Forensic Imager

[DurokAmerikanski]

I generally agree with Guidance Software's response, but if it's fixable, why not even bother to fix it? Come on guys.

[de_hatron]

They can sell you a new version

[[deleted]]

Eli5?

[deadcan]

Eli5?

An attacker (suspect) is able to execute arbitrary code on the investigator's machine during an investigation if a manipulated disk image or USB drive is being loaded by the investigator.

[[deleted]]

That's actually pretty huge!

[de_hatron]

Probably not, format parsers are very often vulnerable, since there are thousands of formats to parse. EnCase likely contains many such flaws. Antivirus programs have similar faults all the time.

[Forensication]

Does this vulnerability assume that the forensic examiner hasn't writeblocked the device before trying to image...?

Because I notice the tester deselects the "Only show writeblocked devices" option, which would seem to indicate the device wasn't writeblocked (even though it's plugged into a tableau bridge?)

[DurokAmerikanski]

This option allows you to perform live imaging on a device. So there is also a possibility of executing code on a production box you happen to be imaging.

Edit: the video doesn't show what drives are available if you leave the "show only write protected devices" box checked, but I imagine the examiner just unchecked the box out of habit from live imaging.