Advisory Details

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Ericom AccessNow Server. Authentication is not required to exploit this vulnerability.

The specific flaw exists in the way AccessServer32.exe handles requests for non-existent files. AccessServer32.exe performs insufficient bounds checking on user-supplied data which results in stack corruption. An attacker can exploit this condition to achieve remote code execution as SYSTEM.

This vulnerability is being disclosed publicly without a patch in accordance with the ZDI vulnerability disclosure policy on lack of vendor response.

Vendor Contact Timeline:
05/02/2014 - ZDI emailed the vendor requesting contact
05/05/2014 - ZDI emailed the vendor requesting contact
05/05/2014 - ZDI called vendor's support and held for 15 minutes with no answer
05/05/2014 - Automated reply from vendor
05/19/2014 - ZDI emailed the vendor requesting contact
05/19/2014 - Automated reply from vendor
05/21/2014 - ZDI emailed the vendor's support requesting contact and indicated final attempt/intent to move toward 0-day
05/21/2014 - Automated reply from vendor
06/02/2014 - Public release of advisory

Mitigation:
Given the nature of the vulnerability, the only salient mitigation strategy is to restrict interaction with the service to trusted machines. Only the clients and servers that have a legitimate procedural relationship with the service should be permitted to communicate with it. This could be accomplished in a number of ways, most notably with firewall rules/whitelisting. These features are available in the native Windows Firewall, as described in http://technet.microsoft.com/en-us/library/cc725770%28WS.10%29.aspx and numerous other Microsoft Knowledge Base articles.

Vendor Patch:
Vendor has issued an update to correct this vulnerability. More details can be found at:

http://www.ericom.com/security-ERM-2014-610.asp

• 2014-05-02 - Vulnerability reported to vendor
• 2014-06-02 - Coordinated public release of advisory