← Advisories

TECO AP-PCLINK 1.094 TPC File Handling Buffer Overflow Vulnerability

High

Advisory ID

ZSL-2015-5278

Release Date

15 November 2015

Vendor

TECO Electric and Machinery Co., Ltd. - http://www.teco-group.eu

Affected Version

1.094

CVE

N/A

Tested On

Microsoft Windows 7 Professional SP1 (EN) 64bit, Microsoft Windows 7 Ultimate SP1 (EN) 64bit

Summary

AP-PCLINK is the supportive software for TP03 or AP series, providing three edit modes as LADDER, IL, FBDand SFC, by which programs can be input rapidly and correctly. Every form written into the TP03 or AP series and AP-PCLINK can be monitored in the form of the data.

Description

The vulnerability is caused due to a boundary error in the processing of a project file, which can be exploited to cause a buffer overflow when a user opens e.g. a specially crafted .TPC file. Successful exploitation could allow execution of arbitrary code on the affected machine.

 Critical error detected c0000374
 (1950.ff0): Break instruction exception - code 80000003 (first chance)
 eax=00000000 ebx=00000000 ecx=76f70b42 edx=0018d98d esi=00360000 edi=41414141
 eip=76fce725 esp=0018dbe0 ebp=0018dc58 iopl=0         nv up ei pl nz na po nc
 cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00200202
 ntdll!RtlpNtEnumerateSubKey+0x1af8:
 76fce725 cc              int     3

Proof of Concept

aptpc.txtTXT

aptpc-5278.zipZIP

Disclosure Timeline

09.10.2015Vulnerability discovered.

15.10.2015Contact with the vendor.

14.11.2015No response from the vendor.

15.11.2015Public security advisory released.

Credits

Vulnerability discovered by Gjoko Krstic

References

[1]https://www.exploit-db.com/exploits/38703/