Sign-up

ID

VAR-201602-0457


TITLE

(0Day) Advantech WebAccess webvrpcs Service BwWebSvc.dll ProjectName/NodeName sprintf Stack-Based Buffer Overflow Remote Code Execution Vulnerability

Trust: 2.1

sources: ZDI: ZDI-16-136 // ZDI: ZDI-16-133 // ZDI: ZDI-16-130

DESCRIPTION

This vulnerability allows remote attackers to execute arbitrary code on vulnerable instances of Advantech WebAccess. Authentication is not required to exploit this vulnerability.The specific flaw exists within the implementation of the 0x13C7C IOCTL in the BwOpcTool subsystem. A stack-based buffer overflow vulnerability exists in a call to sprintf with the ProjectName and NodeName parameters. An attacker can use this vulnerability to execute arbitrary code in the context of an administrator of the system. Advantech WebAccess is prone to multiple stack-based buffer-overflow vulnerabilities because it fails to adequately bounds-check user-supplied data before copying it to an insufficiently sized memory buffer. Failed attacks will likely cause denial-of-service conditions

Trust: 3.42

sources: ZDI: ZDI-16-134 // ZDI: ZDI-16-136 // ZDI: ZDI-16-135 // ZDI: ZDI-16-133 // ZDI: ZDI-16-130 // BID: 83020

AFFECTED PRODUCTS

vendor:advantechmodel:webaccessscope: - version: -

Trust: 3.5

sources: ZDI: ZDI-16-134 // ZDI: ZDI-16-136 // ZDI: ZDI-16-135 // ZDI: ZDI-16-133 // ZDI: ZDI-16-130

CVSS

SEVERITY

CVSSV2

CVSSV3

ZDI: ZDI-16-134
value: HIGH

Trust: 0.7

ZDI: ZDI-16-136
value: HIGH

Trust: 0.7

ZDI: ZDI-16-135
value: HIGH

Trust: 0.7

ZDI: ZDI-16-133
value: HIGH

Trust: 0.7

ZDI: ZDI-16-130
value: HIGH

Trust: 0.7

ZDI: ZDI-16-134
severity: HIGH
baseScore: 9.3
vectorString: AV:N/AC:M/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 8.6
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.7

ZDI: ZDI-16-136
severity: HIGH
baseScore: 9.3
vectorString: AV:N/AC:M/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 8.6
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.7

ZDI: ZDI-16-135
severity: HIGH
baseScore: 9.3
vectorString: AV:N/AC:M/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 8.6
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.7

ZDI: ZDI-16-133
severity: HIGH
baseScore: 9.3
vectorString: AV:N/AC:M/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 8.6
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.7

ZDI: ZDI-16-130
severity: HIGH
baseScore: 9.3
vectorString: AV:N/AC:M/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 8.6
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.7

sources: ZDI: ZDI-16-134 // ZDI: ZDI-16-136 // ZDI: ZDI-16-135 // ZDI: ZDI-16-133 // ZDI: ZDI-16-130

THREAT TYPE

network

Trust: 0.3

sources: BID: 83020

TYPE

Boundary Condition Error

Trust: 0.3

sources: BID: 83020

PATCH

title:This vulnerability is being disclosed publicly without a patch in accordance with the ZDI vulnerability disclosure policy on lack of vendor response.09/15/2015 - 09/17/2015 - ZDI disclosed reports to ICS-CERT (+1 more on 9/29/2015).09/15/2015 and 09/17/2015 - ICS-CERT acknowledged with a tracking number.10/06/2015 - ICS-CERT advised ZDI that the vendor was working on a patch tentatively planned for November.11/10/2015 - ICS-CERT advised ZDI that this patch/next version would be released in early December.12/14/2015 - ZDI asked ICS-CERT if a patch was available. 12/15/2015 - ICS-CERT advised ZDI that a patch release was expected "any day now."12/15/2015 - ICS-CERT inquired with the vendor about the patch.01/06/2016 - ICS-CERT advised ZDI that the vendor released WebAccess 8.1.01/06/2016 - ZDI asked ICS-CERT what fixes are supposed to be in the build. 01/13/2016 - ICS-CERT provided ZDI with a written draft advisory.01/15/2016 - ICS-CERT published an advisory.01/15/2016 - ZDI asked ICS-CERT to confirm CVE mapping.01/22/2016 and 01/26/2016 - ZDI discussed with ICS-CERT by phone the concern that the patch seemed incomplete.01/27/2015 - ZDI concluded that this cases is not patched.02/01/2015 - ZDI notified ICS-CERT intent to release a 0-day advisory02/02/2015 - ZDI advisory released.-- Mitigation:Given the nature of the vulnerability, the only salient mitigation strategy is to restrict interaction with the service to trusted machines. Only the clients and servers that have a legitimate procedural relationship with the service should be permitted to communicate with it. This could be accomplished in a number of ways, most notably with firewall rules/whitelisting. These features are available in the native Windows Firewall, as described in and numerous other Microsoft Knowledge Base articles.url:http://technet.microsoft.com/en-us/library/cc725770%28ws.10%29.aspx

Trust: 3.5

sources: ZDI: ZDI-16-134 // ZDI: ZDI-16-136 // ZDI: ZDI-16-135 // ZDI: ZDI-16-133 // ZDI: ZDI-16-130

EXTERNAL IDS

db:ZDIid:ZDI-16-134

Trust: 1.0

db:ZDIid:ZDI-16-136

Trust: 1.0

db:ZDIid:ZDI-16-135

Trust: 1.0

db:ZDIid:ZDI-16-133

Trust: 1.0

db:ZDIid:ZDI-16-130

Trust: 1.0

db:ZDI_CANid:ZDI-CAN-3167

Trust: 0.7

db:ZDI_CANid:ZDI-CAN-3163

Trust: 0.7

db:ZDI_CANid:ZDI-CAN-3248

Trust: 0.7

db:ZDI_CANid:ZDI-CAN-3160

Trust: 0.7

db:ZDI_CANid:ZDI-CAN-3153

Trust: 0.7

db:BIDid:83020

Trust: 0.3

sources: ZDI: ZDI-16-134 // ZDI: ZDI-16-136 // ZDI: ZDI-16-135 // ZDI: ZDI-16-133 // ZDI: ZDI-16-130 // BID: 83020

REFERENCES

url:http://technet.microsoft.com/en-us/library/cc725770%28ws.10%29.aspx

Trust: 3.5

url:http://webaccess.advantech.com

Trust: 0.3

url:http://www.zerodayinitiative.com/advisories/zdi-16-130

Trust: 0.3

url:http://www.zerodayinitiative.com/advisories/zdi-16-133

Trust: 0.3

url:http://www.zerodayinitiative.com/advisories/zdi-16-134

Trust: 0.3

url:http://www.zerodayinitiative.com/advisories/zdi-16-135

Trust: 0.3

url:http://www.zerodayinitiative.com/advisories/zdi-16-136

Trust: 0.3

sources: ZDI: ZDI-16-134 // ZDI: ZDI-16-136 // ZDI: ZDI-16-135 // ZDI: ZDI-16-133 // ZDI: ZDI-16-130 // BID: 83020

CREDITS

Anonymous

Trust: 3.8

sources: ZDI: ZDI-16-134 // ZDI: ZDI-16-136 // ZDI: ZDI-16-135 // ZDI: ZDI-16-133 // ZDI: ZDI-16-130 // BID: 83020

SOURCES

db:ZDIid:ZDI-16-134
db:ZDIid:ZDI-16-136
db:ZDIid:ZDI-16-135
db:ZDIid:ZDI-16-133
db:ZDIid:ZDI-16-130
db:BIDid:83020

LAST UPDATE DATE

2022-05-17T01:51:03.689000+00:00


SOURCES UPDATE DATE

db:ZDIid:ZDI-16-134date:2016-02-05T00:00:00
db:ZDIid:ZDI-16-136date:2016-02-05T00:00:00
db:ZDIid:ZDI-16-135date:2016-02-05T00:00:00
db:ZDIid:ZDI-16-133date:2016-02-05T00:00:00
db:ZDIid:ZDI-16-130date:2016-02-05T00:00:00
db:BIDid:83020date:2016-07-06T12:17:00

SOURCES RELEASE DATE

db:ZDIid:ZDI-16-134date:2016-02-05T00:00:00
db:ZDIid:ZDI-16-136date:2016-02-05T00:00:00
db:ZDIid:ZDI-16-135date:2016-02-05T00:00:00
db:ZDIid:ZDI-16-133date:2016-02-05T00:00:00
db:ZDIid:ZDI-16-130date:2016-02-05T00:00:00
db:BIDid:83020date:2016-02-05T00:00:00