Advantech WebAccess / SCADA堆栈缓冲区溢出

在开发一个Nessus插件检测cve - 2019 - 3975站得住脚的发现,未经过身份验证的远程堆栈溢出漏洞在Advantech WebAccess / SCADA 8.4.2 BwPAlarm LogInfoFormat函数中存在缺陷。dll由于不当的验证用户提供的数据复制到一个固定大小之前基于堆栈缓冲区在处理一个IOCTL 70533 RPC消息:

。text: 0700674 c ioctl_70533:;代码XREF: _BwRPCPAlarmService + 2 f4b↑j。text: 0700674 c;数据XREF。text: jpt_700672B↓o。text: 0700674 c mov edi (ebp + arg_pInbuf);jumptable 0700672 b案例10533。text: 0700674 f mov [ebp + arg_pOutbuf], esi。text: 07006752推edi。text: 07006753推抵消“字符串”;“BwRpcP_KernelShutdown: % s”。text: 07006758叫LogInfoFormat (char *,…) […][…][…]。text: 07023 e40空白__cdecl LogInfoFormat (char *,…)附近的proc。text: 07023 e40;代码XREF: _BwRPCPAlarmService + 2 f78↑p。text: 07023 e40;_BwRPCPAlarmService + 30 fd↑p。text: 07023 e40。text: 07023 e40 sbuf = -800字节ptr h。text: 07023 = dword ptr 4。text e40格式:07023 e40 Args = 8字节ptr。text: 07023 e40。text: 07023 e40 mov连成一片,[esp +格式]。text: 07023 e44下标esp, 800 h。text: 07023 e4a lea eax, (esp + 800 h + Args);attacker-supplied数据;格式。text: 07023 e4a; string can contain %s, so the data .text:07023E4A ; can overflow the fixed_size, .text:07023E4A ; 0x800-byte stack buffer. .text:07023E51 lea edx, [esp+800h+sbuf] ; 0x800-byte stack buffer .text:07023E55 push eax .text:07023E56 push ecx .text:07023E57 push edx .text:07023E58 call _vsprintf

这里未经过身份验证的远程攻击者可以发送大量数据溢出0 x800-byte堆栈缓冲区函数通过函数。

异常和可利用性Windbg所示:

0:007 > g ModLoad: 005 e0000 005 f0000 C: \ WebAccess \ \ viewsrv节点。dll (de0.c44):访问违例-代码c0000005(第一次)第一次异常报告任何异常处理之前。这个异常可能是预期和处理。eax = 00000001 ebx = 00000001连成一片= 01 e16fb8 edx = 01 e01b4c esi = 00000000 edi = 00000000 eip = 00000000 esp = 0298 eae8 ebp = 0298 f730 iopl = 0 nv了ei pl新西兰na pe数控c = 0023 ss = 002 b d = 002 b es = 002 fs = 0053 gs = 002 b英语= 00010206 41414141 ? ?? ? ?0:007 > kb # ChildEBP RetAddr Args儿童警告:帧IP没有任何已知的模块。后帧可能是错误的。00 0298 eae4 41414141 41414141 41414141 41414141 0 x41414141 01 0298 f730 41414141 a4e x41414141 02 00002925 00000900 00002925 0 0298 f9cc 00402 c75 00878 fd8 02 c920f0 00011385 webvrpcs + 0 x4a4e 03 0298 fa18 00401198 00878 fd8 02 c920f0 00011385 webvrpcs + 0 x2c75 04 0298 fb44 778 e5fda 0087909 c d0b9292e 0087 f628 webvrpcs + 0 x1198 05 0298 fb7c 778 e647b 00401000 0087909 c 0298 fc20 RPCRT4 !DispatchToStubInCNoAvrf + 0 x46 RPCRT4 06 0298 fbd4 778 e6355 00000000 00000000 00000000 !RPC_INTERFACE: DispatchToStubWorker + 0 x158 07年0298 fbf8 77927 e6d 77927 c 77927 00000000 RPCRT4 !RPC_INTERFACE: DispatchToStub + 0 0298 x90 08年fc84 779281公元前00000000 00878 fd8 00879054 RPCRT4 !OSF_SCALL: DispatchHelper + 0 x23f 09年0298 fc98 77928401 00000000 00892738 00000000 fd8 RPCRT4 !OSF_SCALL: DispatchRPCCall + 0 xf5 0 0298 fcc4 779289 a0 00892738 0300092 c 0300092 RPCRT4 !OSF_SCALL: ProcessReceivedPDU + 0 0 b 0298 x223 fce4 77928 b9c 00892738 0000092 c 0000092 c RPCRT4 !OSF_SCALL: BeginRpcCall + 0 0 c 0298 x123 fd40 7793747 f 7793747 00892738 7793747 c RPCRT4 !OSF_SCONNECTION::ProcessReceiveComplete+0x1e1 0d 0298fd54 7794bf8f 00895890 0000000c 00000000 RPCRT4!ProcessConnectionServerReceivedEvent+0x1c 0e 0298fd78 7794c188 00895890 0000000c 00000000 RPCRT4!DispatchIOHelper+0x46 0f 0298fdb0 75af818c 0000052c 00000000 0087e058 RPCRT4!CO_ConnectionThreadPoolCallback+0x120 10 0298fdd4 77df4cd6 0298fe74 00872370 0087e058 KERNELBASE!BasepTpIoCallback+0x2f 11 0298fe30 77dcfb5b 0298fe74 008603e8 0087e058 ntdll!TppIopExecuteCallback+0x1c5 12 0298ff88 758d343d 008725b0 0298ffd4 77db9832 ntdll!TppWorkerThread+0x594 13 0298ff94 77db9832 008725b0 75606122 00000000 kernel32!BaseThreadInitThunk+0xe 14 0298ffd4 77db9805 77dd04bc 008725b0 ffffffff ntdll!__RtlUserThreadStart+0x70 15 0298ffec 00000000 77dd04bc 008725b0 00000000 ntdll!_RtlUserThreadStart+0x1b 0:007> .load msec.dll 0:007> !exploitable !exploitable 1.6.0.0 Exploitability Classification: EXPLOITABLE Recommended Bug Title: Exploitable - Data Execution Prevention Violation starting at Unknown Symbol @ 0x0000000041414141 called from webvrpcs+0x0000000000004a4e (Hash=0xdd0ef56a.0xbb1bd46e) User mode DEP access violations are exploitable.