DATAC RealWin <= 2.0 (Build 6.1.8.10) Buffer Overflow Vulnerabilities

2010-10-16 09:16:06

Source: http://aluigi.org/adv/realwin_1-adv.txt

#######################################################################

Luigi Auriemma

Application: DATAC RealWin
http://www.dataconline.com/software/realwin.php
http://www.realflex.com
Versions: <= 2.0 (Build 6.1.8.10)
Platforms: Windows
Bugs: A] stack overflow in SCPC_INITIALIZE and SCPC_INITIALIZE_RF
B] stack overflow in SCPC_TXTEVENT
Exploitation: remote, versus server
Date: 15 Oct 2010
Author: Luigi Auriemma
e-mail: [email protected]
web: aluigi.org


#######################################################################


1) Introduction
2) Bugs
3) The Code
4) Fix


#######################################################################

===============
1) Introduction
===============


"RealWin is a SCADA server package for medium / small applications."


#######################################################################

=======
2) Bugs
=======


-----------------------------------------------------------
A] stack overflow in SCPC_INITIALIZE and SCPC_INITIALIZE_RF
-----------------------------------------------------------

The service of the server running on port 912 is vulnerable to a
stack based buffer-overflow caused by the usage of sprintf() for
building a particular string with the data supplied by the attacker:

sprintf(
stack_buffer,
"C:\\Program Files\\...path_of_RealWin...\\data\\crt\\fwd\\tel\\%s.%d",
attacker_string,
attacker_16bit_number);


----------------------------------
B] stack overflow in SCPC_TXTEVENT
----------------------------------

The same server is vulnerable also to another stack based overflow
caused by the usage of strcpy() with the data supplied by the attacker.


#######################################################################

===========
3) The Code
===========


http://aluigi.org/poc/realwin_1.zip
http://www.exploit-db.com/sploits/realwin_1.zip

nc SERVER 912 < realwin_1a.dat
nc SERVER 912 < realwin_1b.dat
nc SERVER 912 < realwin_1c.dat


#######################################################################

======
4) Fix
======


No fix.


#######################################################################

Fixes

No fixes

In order to submit a new fix you need to be registered.