82 lines
No EOL
1.9 KiB
Text
82 lines
No EOL
1.9 KiB
Text
Application: BroadWin WebAccess Client
|
|
http://broadwin.com/Client.htm
|
|
Versions: bwocxrun.ocx <= 1.0.0.10 (aka version 7.0)
|
|
Platforms: Windows
|
|
Bugs: A] format string
|
|
B] arbitrary memory corruption
|
|
Exploitation: remote
|
|
Date: 02 Sep 2011
|
|
Author: Luigi Auriemma
|
|
e-mail: aluigi@autistici.org
|
|
web: aluigi.org
|
|
|
|
|
|
#######################################################################
|
|
|
|
|
|
1) Introduction
|
|
2) Bugs
|
|
3) The Code
|
|
4) Fix
|
|
|
|
|
|
#######################################################################
|
|
|
|
===============
|
|
1) Introduction
|
|
===============
|
|
|
|
|
|
From vendor's website:
|
|
"WebAccess is the first fully web browser-based software package for
|
|
human-machine interfaces (HMI), and supervisory control and data
|
|
acquisition (SCADA)."
|
|
|
|
The various operations are handled by the bwocxrun.ocx ActiveX
|
|
component which is available (but it's not updated) also in Advantech
|
|
WebAccess (http://webaccess.advantech.com).
|
|
|
|
|
|
#######################################################################
|
|
|
|
=======
|
|
2) Bugs
|
|
=======
|
|
|
|
----------------
|
|
A] format string
|
|
----------------
|
|
|
|
The OcxSpool function is affected by a format string vulnerability
|
|
caused by the usage of the Msg string provided by the attacker directly
|
|
with vsprintf() without the required format argument.
|
|
|
|
|
|
------------------------------
|
|
B] arbitrary memory corruption
|
|
------------------------------
|
|
|
|
WriteTextData and CloseFile allow to corrupt arbitrary zones of the
|
|
memory through a fully controllable stream identifier in fclose() and
|
|
fwrite().
|
|
|
|
|
|
#######################################################################
|
|
|
|
===========
|
|
3) The Code
|
|
===========
|
|
|
|
|
|
http://aluigi.org/poc/bwocxrun_1.zip
|
|
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/17772.zip (bwocxrun_1.zip)
|
|
|
|
|
|
#######################################################################
|
|
|
|
======
|
|
4) Fix
|
|
======
|
|
|
|
|
|
No fix. |