ID
VAR-201708-1718
TITLE
(0Day) Eaton ELCSoft ELCSimulator Stack-based Buffer Overflow Remote Code Execution Vulnerability
Trust: 0.7
DESCRIPTION
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Eaton ELCSoft. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of network TCP requests by ELCSimulator.exe. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute arbitrary code in the context of the process.
Trust: 0.7
AFFECTED PRODUCTS
| vendor: | eaton | model: | elcsoft | scope: | - | version: | - | Trust: 0.7 |
CVSS
SEVERITY | CVSSV2 | CVSSV3 | ||||||||||||||||||||||||||||||||||||||||||
|
|
PATCH
| title: | This vulnerability is being disclosed publicly without a patch in accordance with the ZDI 120 day deadline.10/11/2016 - ZDI disclosed the report to ICS-CERT11/01/2016 - The vendor requested additional details from ZDI through ICS-CERT11/07/2016 - ZDI provided additional details as requested 03/13/2017, 03/17/2017, and 03/29/2017 - ICS-CERT replied that the vendor cannot validate these on the latest and asked if ZDI could re-vet against their latest version04/05/2017 - ZDI replied that this report still hits07/12/2017 - ZDI requested an update from ICS-CERT07/13/2017 - ICS-CERT indicated that to their knowledge the vendor has not yet created a relevant patch07/20/2017 - ZDI notified the vendor of the intention to publish the report as 0-day-- Mitigation:Given the nature of the vulnerability, the only salient mitigation strategy is to restrict interaction with the service to trusted machines. Only the clients and servers that have a legitimate procedural relationship with the service should be permitted to communicate with it. This could be accomplished in a number of ways, most notably with firewall rules/whitelisting. These features are available in the native Windows Firewall, as described in and numerous other Microsoft Knowledge Base articles. | url: | http://technet.microsoft.com/en-us/library/cc725770%28ws.10%29.aspx | Trust: 0.7 |
EXTERNAL IDS
| db: | ZDI_CAN | id: | ZDI-CAN-4037 | Trust: 0.7 |
| db: | ZDI | id: | ZDI-17-520 | Trust: 0.7 |
REFERENCES
| url: | http://technet.microsoft.com/en-us/library/cc725770%28ws.10%29.aspx | Trust: 0.7 |
CREDITS
Ariele Caltabiano(kimiya)
Trust: 0.7
SOURCES
| db: | ZDI | id: | ZDI-17-520 |
LAST UPDATE DATE
2022-05-17T01:52:36.372000+00:00
SOURCES UPDATE DATE
| db: | ZDI | id: | ZDI-17-520 | date: | 2017-08-07T00:00:00 |
SOURCES RELEASE DATE
| db: | ZDI | id: | ZDI-17-520 | date: | 2017-08-07T00:00:00 |