A local buffer overflow vulnerability in LizardSystems LanSpy 2.0.1.159 could allow an attacker to achieve remote code execution on the host machine.

This is a local buffer overflow (CWE-787) triggered by supplying an oversized string to the scan input field. The vulnerability is exploitable by an unauthenticated local user who can overwrite the instruction pointer to facilitate code execution.

The successful exploitation of this vulnerability poses a severe risk to system integrity and availability. An attacker could crash the LanSpy application, resulting in a denial of service, or execute arbitrary code with the privileges of the user running the application. Given the CVSS score of 8.4, this vulnerability is classified as High severity and requires immediate attention to prevent potential system compromise.

Immediate Action: As there is no official patch currently available, users should restrict access to the application and avoid entering untrusted data into the scan field. Contact the vendor for information regarding a potential security update or a supported version upgrade.

Proactive Monitoring: Security teams should monitor endpoint logs for unusual application crashes or unexpected child processes spawned by the LanSpy executable.

Compensating Controls: Implement endpoint protection solutions that detect and block buffer overflow attempts or unauthorized memory access patterns. Use restricted user accounts to run the application to minimize the potential impact of code execution.

Public Exploit Available: Yes, a proof of concept is available via the Exploit Database (EDB-ID 45968).

The presence of a public proof of concept elevates the risk of this vulnerability. Organizations using LanSpy 2.0.1.159 should prioritize isolating affected systems from untrusted input and seek guidance from LizardSystems regarding a secure version. Mitigate the risk by applying robust endpoint security controls and restricting user access to the application until a formal patch is released.