Advisory Details

February 5th, 2016

(0Day) Advantech WebAccess webvrpcs Service BwWebSvc.dll ProjectName sprintf Stack-Based Buffer Overflow Remote Code Execution Vulnerability

ZDI-16-147
ZDI-CAN-3170

CVE ID
CVSS SCORE 9.3, AV:N/AC:M/Au:N/C:C/I:C/A:C
AFFECTED VENDORS Advantech
AFFECTED PRODUCTS WebAccess
TREND MICRO CUSTOMER PROTECTION Trend Micro TippingPoint IPS customers are protected against this vulnerability by Digital Vaccine protection filter ID ['21019']. For further product information on the TippingPoint IPS: http://www.tippingpoint.com
VULNERABILITY DETAILS


This vulnerability allows remote attackers to execute arbitrary code on vulnerable instances of Advantech WebAccess. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the implementation of the 0x13C71 IOCTL in the BwOpcTool subsystem. A stack-based buffer overflow vulnerability exists in a call to sprintf using the ProjectName parameter. An attacker can use this vulnerability to execute arbitrary code in the context of an administrator of the system.
ADDITIONAL DETAILS


This vulnerability is being disclosed publicly without a patch in accordance with the ZDI vulnerability disclosure policy on lack of vendor response.

09/15/2015 - 09/17/2015 - ZDI disclosed reports to ICS-CERT (+1 more on 9/29/2015).
09/15/2015 and 09/17/2015 - ICS-CERT acknowledged with a tracking number.
10/06/2015 - ICS-CERT advised ZDI that the vendor was working on a patch tentatively planned for November.
11/10/2015 - ICS-CERT advised ZDI that this patch/next version would be released in early December.
12/14/2015 - ZDI asked ICS-CERT if a patch was available.
12/15/2015 - ICS-CERT advised ZDI that a patch release was expected "any day now."
12/15/2015 - ICS-CERT inquired with the vendor about the patch.
01/06/2016 - ICS-CERT advised ZDI that the vendor released WebAccess 8.1.
01/06/2016 - ZDI asked ICS-CERT what fixes are supposed to be in the build.
01/13/2016 - ICS-CERT provided ZDI with a written draft advisory.
01/15/2016 - ICS-CERT published an advisory.
01/15/2016 - ZDI asked ICS-CERT to confirm CVE mapping.
01/22/2016 and 01/26/2016 - ZDI discussed with ICS-CERT by phone the concern that the patch seemed incomplete.
01/27/2015 - ZDI concluded that this cases is not patched.
02/01/2015 - ZDI notified ICS-CERT intent to release a 0-day advisory
02/02/2015 - ZDI advisory released.

-- Mitigation:

Given the nature of the vulnerability, the only salient mitigation strategy is to restrict interaction with the service to trusted machines. Only the clients and servers that have a legitimate procedural relationship with the service should be permitted to communicate with it. This could be accomplished in a number of ways, most notably with firewall rules/whitelisting. These features are available in the native Windows Firewall, as described in http://technet.microsoft.com/en-us/library/cc725770%28WS.10%29.aspx and numerous other Microsoft Knowledge Base articles.
DISCLOSURE TIMELINE
  • 2015-09-16 - Vulnerability reported to vendor
  • 2016-02-05 - Coordinated public release of advisory
CREDIT Anonymous
BACK TO ADVISORIES