Cogent DataHub 7.1.1.63 - Stack Overflow
| Reporter | Title | Published | Views | Family All 10 |
|---|---|---|---|---|
 | CVE-2011-3493 | 22 Sep 201100:00 | – | circl |
 | CVE-2011-3493 | 16 Sep 201114:00 | – | cve |
 | CVE-2011-3493 | 16 Sep 201114:00 | – | cvelist |
 | Cogent Datahub 7.1.1.63 - Remote Unicode Buffer Overflow | 22 Sep 201100:00 | – | exploitdb |
 | Cogent DataHub Vulnerabilities | 10 Jul 201106:00 | – | ics |
 | CVE-2011-3493 | 16 Sep 201114:28 | – | nvd |
 | Cogent DataHub Unicode Buffer Overflow Vulnerability - Active Check | 22 Sep 201100:00 | – | openvas |
| Cogent DataHub Unicode Buffer Overflow Vulnerability | 22 Sep 201100:00 | – | openvas |
 | Stack overflow | 16 Sep 201114:28 | – | prion |
 | CVE-2011-3493 | 22 May 202504:14 | – | redhatcve |
10
#######################################################################
Luigi Auriemma
Application: Cogent DataHub
http://www.cogentdatahub.com/Products/Cogent_DataHub.html
Versions: <= 7.1.1.63
Platforms: Windows
Bug: stack unicode overflow
Exploitation: remote
Date: 13 Sep 2011
Author: Luigi Auriemma
e-mail: [email protected]
web: aluigi.org
#######################################################################
1) Introduction
2) Bug
3) The Code
4) Fix
#######################################################################
===============
1) Introduction
===============
DataHub is a software for the SCADA and automation sector.
#######################################################################
======
2) Bug
======
The server/service listens on the ports 4052 and 4053, the only
difference is that the second port uses SSL while the first one is in
plain-text.
Stack-based unicode buffer-overflow in the "DH_OneSecondTick" function
exploitable through the "domain", "report_domain", "register_datahub",
"slave" and some other commands:
00440442 |. 50 |PUSH EAX ; string
00440443 |. 68 64854900 |PUSH CogentDa.00498564 ; "Domain"
00440448 |. 8D8D 00FFFFFF |LEA ECX,DWORD PTR SS:[EBP-100]
0044044E |. 68 A42F4900 |PUSH CogentDa.00492FA4 ; "%s.%s"
00440453 |. 51 |PUSH ECX ; stack buffer
00440454 |. FF15 B4F44800 |CALL DWORD PTR DS:[<&MSVCR90._swprintf>]
#######################################################################
===========
3) The Code
===========
http://aluigi.org/poc/cogent_1.dat
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/17838.dat
nc SERVER 4052 < cogent_1.dat
port 4053 uses the same protocol via SSL.
#######################################################################
======
4) Fix
======
No fix.
#######################################################################Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
14 Sep 2011 00:00Current
5.2Medium risk
Vulners AI Score5.2
CVSS 210
EPSS0.07991