Arm Whois 3.11 stack-based buffer overflow in IP address/domain input handling

# check-armwhois.ps1

# Detect Arm Whois 3.11 presence on Windows.

# Exit codes:

#   0 = PATCHED / not installed

#   1 = VULNERABLE

#   2 = UNKNOWN


$ErrorActionPreference = 'SilentlyContinue'

function Write-Result {
    param(
        [string]$Status,
        [string]$Message,
        [int]$Code
    )
    Write-Output "$Status - $Message"
    exit $Code
}

$candidates = @()

# Common install paths

$paths = @(
    "$env:ProgramFiles\Arm Whois\arm-whois.exe",
    "$env:ProgramFiles(x86)\Arm Whois\arm-whois.exe",
    "$env:ProgramFiles\Armcode\Arm Whois\arm-whois.exe",
    "$env:ProgramFiles(x86)\Armcode\Arm Whois\arm-whois.exe"
)

foreach ($p in $paths) {
    if (Test-Path $p) { $candidates += $p }
}

# Uninstall registry search

$uninstallRoots = @(
    'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*',
    'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*',
    'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*'
)

$regHits = foreach ($root in $uninstallRoots) {
    Get-ItemProperty $root | Where-Object {
        $_.DisplayName -match 'Arm Whois'
    }
}

foreach ($hit in $regHits) {
    if ($hit.DisplayIcon -and (Test-Path ($hit.DisplayIcon -replace ',0$',''))) {
        $candidates += ($hit.DisplayIcon -replace ',0$','')
    }
    if ($hit.InstallLocation) {
        $exe = Join-Path $hit.InstallLocation 'arm-whois.exe'
        if (Test-Path $exe) { $candidates += $exe }
    }
}

$candidates = $candidates | Sort-Object -Unique

if (-not $candidates -or $candidates.Count -eq 0) {
    Write-Result 'PATCHED' 'Arm Whois not found on this host (software absent).' 0
}

foreach ($exe in $candidates) {
    $item = Get-Item $exe
    if (-not $item) { continue }

    $version = $item.VersionInfo.ProductVersion
    if (-not $version) { $version = $item.VersionInfo.FileVersion }
    if (-not $version) { $version = 'UNKNOWN' }

    if ($version -match '^3\.11(\.|$)?') {
        Write-Result 'VULNERABLE' "Found Arm Whois version $version at $exe" 1
    }
}

# If we found the product but not version 3.11, we cannot verify a fixed release publicly.

$foundList = ($candidates -join '; ')
Write-Result 'UNKNOWN' "Arm Whois found, but not version 3.11. Public fixed-version data is not verified. Paths: $foundList" 2