[R1] HPE LoadRunner libxdrutil.dll mxdr_string() Function XDR String Handling Remote Heap Buffer Overflow

While examining the protocol used by the LoadRunner agent to develop Nessus detection plugins for previous vulnerabilities, Tenable found a heap buffer overflow issue that may allow for remote code execution. The flaw is in the mxdr_string() function of the libxdrutil.dll library. An attacker can craft an XDR string with a very large length (i.e., 0xfffffffc), which when processed in libxdrutil.dll!mxdr_string(), the function ends up allocating 0xffffffffc + 5 = 1 byte from the heap, which causes a small buffer to be returned. Next, the function copies 0xfffffffc bytes of attacker-controlled data to the small buffer, resulting in a heap buffer overflow. Technical shared the technical debugging / crash pleasantry with ZDI.

This was tested against HPE LoadRunner 12.53.0 running on 32-bit Windows 2008 SP2. Tenable generated a Python PoC script (loadrunner_mxdr_string_heap_overflow.py) that demonstrates this issue. If you are with ZDI you have a copy. Otherwise, sorry!