While researching ICSA-21-285-03 for Nessus plugin coverage, Tenable found multiple vulnerabilities in Schneider Electric IGSS Data Collector (dc.exe) v15.0.0.21301.
Unauthenticated Remote File Deletion
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L (6.5)
The IGSS Data Collector (dc.exe) does not check the user-supplied file to be deleted when handling opcode 60. An unauthenticated remote attacker knowing the IGSS project directory can exploit this to delete arbitrary files on the dc.exe host under the security context of the user account running dc.exe.
POC:
Unauthenticated Remote DoS
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H (5.9)
The IGSS Data Collector (dc.exe) does not properly check the user-supplied size of compressed data when handling opcode 101. dc.exe does a signed integer comparison for the check. A negative size will pass the check but that size will be treated as a very large positive integer later when it's passed to memcpy():
<...snip...>
.text:0047EE69 mov ecx, [eax+1Ch] ; attacker-controlled size
.text:0047EE6C mov [ebp+DataSize], ecx
.text:0047EE72 mov edx, [ebp+var_2D8]
.text:0047EE78 mov eax, [edx]
.text:0047EE7A add eax, [ebp+DataSize]
.text:0047EE80 cmp eax, 7534h
.text:0047EE85 signed int comparison
.text:0047EE85 0xffffffff (-1) would pass the size check
.text:0047EE85 jle short ok_47EEF1 ; attacker-controlled size
.text:0047EE85 ; (i.e., 0xffffffff)
<...snip...>
.text:0047EEF1 ok_47EEF1: ; CODE XREF: sn_receive_file+225↑j
.text:0047EEF1 mov edx, [ebp+DataSize] ; attacker-controlled size
.text:0047EEF1 ; (i.e., 0xffffffff)
.text:0047EEF7 push edx ; Size
.text:0047EEF8 mov eax, [ebp+arg_0]
.text:0047EEFB add eax, 20h ; ' '
.text:0047EEFE push eax ; Src
.text:0047EEFF mov ecx, [ebp+var_2D8]
.text:0047EF05 mov edx, [ecx+14h]
.text:0047EF08 mov eax, [ebp+var_2D8]
.text:0047EF0E add edx, [eax]
.text:0047EF10 push edx ; void *
.text:0047EF11 call memcpy
<...snip...>
An unauthenticated remote attacker knowing the IGSS project directory can exploit this to crash dc.exe, which restarts.
POC: