A local buffer overflow vulnerability in Nsasoft SpotAuditor 5.3.2 allows for potential arbitrary code execution, posing a significant risk to local system integrity.

The software contains a stack-based buffer overflow (CWE-121) within the Base64 Encrypted Password tool. An unauthenticated local attacker can provide a specially crafted payload to trigger a Structured Exception Handler (SEH) overwrite, which facilitates the execution of arbitrary shellcode.

A successful exploit allows an attacker with local access to execute arbitrary code with the privileges of the application. This could lead to a full compromise of the local system, including the theft of stored credentials or unauthorized access to sensitive data processed by the auditing tool. Given the CVSS score of 8.4, this vulnerability represents a high-severity risk that demands immediate attention for any systems utilizing this software.

Immediate Action: As no official patch is available for this legacy version, the primary remediation is to uninstall or restrict access to the Nsasoft SpotAuditor software on all workstations and servers.

Proactive Monitoring: Security teams should monitor system logs for unusual process crashes or unauthorized attempts to execute code within the context of the SpotAuditor application directory.

Compensating Controls: Implement strict host-based access controls to prevent unauthorized users from executing the application or interacting with its input fields.

Public Exploit Available: Yes, published proof-of-concept exploits exist on ExploitDB (EDB-ID 47759 and EDB-ID 47719).

Due to the availability of functional exploit code and the lack of vendor-supplied patches, this software should be considered insecure for deployment in a production environment. Organizations must prioritize the removal of SpotAuditor 5.3.2 and transition to supported, secure auditing alternatives to mitigate the risk of arbitrary code execution.