← Advisories

MA Lighting Technology grandMA onPC v6.808 Remote Denial of Service Exploit

Medium
Advisory ID
ZSL-2014-5183
Release Date
03 April 2014
Vendor
MA Lighting Technology GmbH - http://www.malighting.com
Affected Version
grandMA series 1 onPC Software 6.808 (6.801)
CVE
N/A
Tested On
Microsoft Windows 7 Professional SP1 (EN)
Summary

The grandMA onPC software incorporates all functions of a grandMA console and offers you its full potential on your notebook or PC. You can use grandMA onPC for running, programming or offline pre-programming, as well as a smart backup solution within the grandMA system. With the MA onPC command wing and MA onPC fader wing MA Lighting has developed a sophisticated hardware extension perfectly suited for the grandMA onPC software.

Description

grandMA onPC version 6.808 is exposed to a remote denial of service issue when processing socket connection negotiation. This issue occurs when the application handles a single malformed packet over TCP port 7003, resulting in a crash.

(1324.be4): Access violation - code c0000005 (first chance) First chance exceptions are reported before any exception handling. This exception may be expected and handled. eax=3535393f ebx=07279f80 ecx=35353937 edx=0c05f038 esi=3535393f edi=3535393b eip=77ce22c2 esp=0c05ef7c ebp=0c05ef90 iopl=0 nv up ei pl nz ac pe nc cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010216 ntdll!RtlEnterCriticalSection+0x12: 77ce22c2 f00fba3000 lock btr dword ptr [eax],0 ds:002b:3535393f=???????? -- 303.640 GMA : RR NEW STATION IN NETWORK 127.0.0.1(100) AS Standalone 367.147 SHAR: RPC COMMAND UNSUPPORTED CMD 542393671 from 127.0.0.1 367.147 SHAR: SHARED_REMOTECALL NOT TERMINATED CORRECTLY ! 367.180 CC : ******* EXCEPTION ************************** 367.180 CC : * ACCESS_VIOLATION 367.180 CC : * EAX = 37363341 EBX = 6D856B0 367.180 CC : * ECX = 37363339 EDX = B78F41C 367.180 CC : * ESI = 37363341 EDI = 3736333D 367.180 CC : * DESKTYP : GMA [Windows] 367.180 CC : * VERSION : 6.808 STREAMING : 6801 367.180 CC : ******************************************** 367.240 CC : 0x775522c2 RtlEnterCriticalSection() + 0x12
Proof of Concept
Disclosure Timeline
31.03.2014Vulnerability discovered.
31.03.2014Vendor contacted.
02.04.2014No reply from the vendor.
03.04.2014Public security advisory released.
Credits
Vulnerability discovered by Gjoko Krstic
References
Changelog
03.04.2014Initial release
08.04.2014Added reference [2], [3], [4] and [5]
10.04.2014Added reference [6]