A local buffer overflow vulnerability in EKG Gadu 1.9~pre+r2855-3+b1 allows local attackers to achieve arbitrary code execution with user privileges.

This is a local buffer overflow (CWE-787) triggered when the application fails to properly validate the length of a username string. An attacker with local access can supply a buffer exceeding 258 bytes to the strlcpy function, causing an out-of-bounds write that overwrites the instruction pointer and redirects execution flow to attacker-supplied shellcode.

The exploitation of this vulnerability allows an unauthorized local user to execute arbitrary code with the privileges of the EKG Gadu process. While the CVSS score of 8.4 reflects a high severity, the requirement for local access limits the attack surface to users already present on the system. Successful exploitation could lead to full system compromise of the user account running the application and potential lateral movement within the environment.

Immediate Action: There is currently no official patch available for this legacy software; users are advised to restrict access to the application or uninstall it if it is no longer required for business operations.

Proactive Monitoring: Review system logs for unusual execution patterns or segmentation faults associated with the ekg process, which may indicate attempted exploitation.

Compensating Controls: Implement strict file system permissions to limit which users can execute the binary and ensure that the principle of least privilege is applied to any account authorized to run the software.

Public Exploit Available: Yes, a public exploit exists as documented in the Exploit Database (EDB-ID: 40392).

Given the availability of functional exploit code and the lack of a vendor-provided security update, EKG Gadu should be considered insecure for use in production environments. Organizations are strongly encouraged to decommission the application or migrate to a supported alternative to eliminate the risk of local code execution.