BroadWin Webaccess Client - Multiple Vulnerabilities
| Reporter | Title | Published | Views | Family All 11 |
|---|---|---|---|---|
 | Advantech WebAccess < 7.0-2009.06.29 Multiple Vulnerabilities | 14 Feb 201700:00 | – | nessus |
| Advantech WebAccess < 7.0-2009.06.29 Multiple Vulnerabilities | 28 Aug 201500:00 | – | nessus |
 | CVE-2012-0241 | 21 Feb 201211:00 | – | cve |
| CVE-2012-0242 | 21 Feb 201211:00 | – | cve |
 | CVE-2012-0241 | 21 Feb 201211:00 | – | cvelist |
| CVE-2012-0242 | 21 Feb 201211:00 | – | cvelist |
 | BroadWin Webaccess SCADA/HMI Client - Remote Code Execution | 31 Oct 201100:00 | – | exploitdb |
 | CVE-2012-0241 | 21 Feb 201213:31 | – | nvd |
| CVE-2012-0242 | 21 Feb 201213:31 | – | nvd |
 | Memory corruption | 21 Feb 201213:31 | – | prion |
10
Application: BroadWin WebAccess Client
http://broadwin.com/Client.htm
Versions: bwocxrun.ocx <= 1.0.0.10 (aka version 7.0)
Platforms: Windows
Bugs: A] format string
B] arbitrary memory corruption
Exploitation: remote
Date: 02 Sep 2011
Author: Luigi Auriemma
e-mail: [email protected]
web: aluigi.org
#######################################################################
1) Introduction
2) Bugs
3) The Code
4) Fix
#######################################################################
===============
1) Introduction
===============
From vendor's website:
"WebAccess is the first fully web browser-based software package for
human-machine interfaces (HMI), and supervisory control and data
acquisition (SCADA)."
The various operations are handled by the bwocxrun.ocx ActiveX
component which is available (but it's not updated) also in Advantech
WebAccess (http://webaccess.advantech.com).
#######################################################################
=======
2) Bugs
=======
----------------
A] format string
----------------
The OcxSpool function is affected by a format string vulnerability
caused by the usage of the Msg string provided by the attacker directly
with vsprintf() without the required format argument.
------------------------------
B] arbitrary memory corruption
------------------------------
WriteTextData and CloseFile allow to corrupt arbitrary zones of the
memory through a fully controllable stream identifier in fclose() and
fwrite().
#######################################################################
===========
3) The Code
===========
http://aluigi.org/poc/bwocxrun_1.zip
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/17772.zip (bwocxrun_1.zip)
#######################################################################
======
4) Fix
======
No fix.Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
02 Sep 2011 00:00Current
5.2Medium risk
Vulners AI Score5.2
CVSS 210
EPSS0.07173