Tenable discovered an unauthenticated, remote stack overflow vulnerability in WebAccess/SCADA version 8.4.1.
CVE-2019-3975: Unauthenticated Remote Stack Buffer Overflow
The flaw exists in the GetUserPasswd function in BwPAlarm.dll due to improper validation of user-supplied data before copying the data to a fixed size stack-based buffer when processing an IOCTL 70603 RPC message.
The following snippet shows the vulnerability:
.text:0700700A mov esi, [ebp+arg_pInbuf] ; jumptable 07006EDB case 10603
.text:0700700D xor eax, eax
.text:0700700F mov [ebp+var_20], eax
.text:07007012 mov [ebp+var_18], eax
.text:07007015 lea ecx, [ebp+var_DecodedLen]
.text:07007018 lea eax, [ebp+b64Decoded]
.text:0700701E lea edx, [esi+10h]
.text:07007021 push ecx ; int *
.text:07007022 push eax ; unsigned __int8 *
.text:07007023 mov edi, edx
.text:07007025 or ecx, 0FFFFFFFFh
.text:07007028 xor eax, eax
.text:0700702A repne scasb
.text:0700702C not ecx
.text:0700702E dec ecx
.text:0700702F mov [ebp+var_DecodedLen], 104h ; max decoded len: 0x104 bytes
.text:07007036 push ecx
.text:07007037 push edx ; attacked-controlled
.text:07007037 ; base64-encoded data
.text:07007038 call base64_decode(uchar const *,int,uchar *,int *)
.text:0700703D mov ecx, [ebp+var_DecodedLen]
.text:07007040 lea edx, [ebp+passwd_5C] ; 0x5C bytes to function return address:
.text:07007040 ; stack overflow!!!
.text:07007043 lea eax, [ebp+user_9C]
.text:07007049 push edx
.text:0700704A mov [ebp+ecx+b64Decoded], 0
.text:07007052 lea ecx, [ebp+b64Decoded] ; attacker-controlled; up to 0x104 bytes
.text:07007058 push eax
.text:07007059 push ecx
.text:0700705A call GetUserPasswd(char *,char *,char *)
The GetUserPasswd function expects the Base64-decoded data to be in the form of 'USER:PASSWD' and copies the 'user' part to 'user' buffer on the stack and the 'passwd' part to the 'passwd' buffer on the stack. Because both the 'user' and the 'passwd' buffers can be smaller than the input data, a stack-based buffer overflow can occur.
The crash of webvrpcs.exe is shown in Windbg and the Windbg !exploitable extension shows the vulnerability is exploitable:
0:014> g
ModLoad: 00470000 00480000 C:\WebAccess\Node\viewsrv.dll
(1be4.bfc): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
*** WARNING: Unable to verify checksum for C:\WebAccess\Node\BwPAlarm.dll
eax=00000000 ebx=00000000 ecx=ffffffff edx=02e3ea00 esi=004bb130 edi=41414141
eip=070012e7 esp=02e3e9e8 ebp=02e3f708 iopl=0 nv up ei ng nz na pe nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010286
BwPAlarm+0x12e7:
070012e7 f2ae repne scas byte ptr es:[edi]
0:012> kb
ChildEBP RetAddr Args to Child
02e3eaac 070070a5 41414141 41414152 41414162 BwPAlarm+0x12e7
00000000 00000000 00000000 00000000 00000000 BwPAlarm+0x70a5
0:012> .load msec.dll
0:012> !exploitable
!exploitable 1.6.0.0
Exploitability Classification: EXPLOITABLE
Recommended Bug Title: Exploitable - Exception Handler Chain Corrupted starting at BwPAlarm+0x00000000000012e7 (Hash=0xdfb6d31b.0xf5f1cde0)
Corruption of the exception handler chain is considered exploitable