Synopsis
While developing a Nessus plugin to detect CVE-2017-16720, Tenable found an unauthenticated remote stack buffer overflow in BwPAlarm.dll shipped with Advantech WebAccess version 8.3.2. The flaw is due to improper validation of user-supplied input. The overflow can be triggered by sending a specially crafted DCERPC message with opcode 70022 to webvrpcs.exe.
The following disassembly shows the vulnerable code copies a user-supplied string to a fixed-size stack buffer:
.text:0700391E lea edx, [ebp+var_59C] ; stack buffer of fixed size .text:07003924 repne scasb ; edi = user-supplied string .text:07003926 not ecx ; length of the string including the NUL char .text:07003928 sub edi, ecx .text:0700392A push 3Ah .text:0700392C mov eax, ecx .text:0700392E mov esi, edi .text:07003930 mov edi, edx .text:07003932 shr ecx, 2 .text:07003935 rep movsd ; strcpy(stack_buf, long_str) = stack overflow!!! .text:07003937 mov ecx, eax .text:07003939 and ecx, 3 .text:0700393C rep movsb
Solution
Upgrade to Advantech WebAccess 8.3.4 or newer.Additional References
https://support.advantech.com/support/DownloadSRDetail_New.aspx?SR_ID=1-MS9MJV&Doc_Source=Downloadhttps://ics-cert.us-cert.gov/advisories/ICSA-18-352-02
Disclosure Timeline
All information within TRA advisories is provided “as is”, without warranty of any kind, including the implied warranties of merchantability and fitness for a particular purpose, and with no guarantee of completeness, accuracy, or timeliness. Individuals and organizations are responsible for assessing the impact of any actual or potential security vulnerability.
Tenable takes product security very seriously. If you believe you have found a vulnerability in one of our products, we ask that you please work with us to quickly resolve it in order to protect customers. Tenable believes in responding quickly to such reports, maintaining communication with researchers, and providing a solution in short order.
For more details on submitting vulnerability information, please see our Vulnerability Reporting Guidelines page.
If you have questions or corrections about this advisory, please email [email protected]
Contact our sales team