← Advisories

Delta Industrial Automation DCISoft 1.12.09 Stack Buffer Overflow Exploit

High

Advisory ID

ZSL-2016-5305

Release Date

14 February 2016

Vendor

Delta Electronics, Inc. - http://www.delta.com.tw

Affected Version

1.12.09 (Build 12102014)

CVE

N/A

Tested On

Microsoft Windows 7 Professional SP1 (EN), Microsoft Windows 7 Ultimate SP1 (EN)

Summary

DCISoft is a integrated configuration tool of Delta network modules (DVPEN01-SL, RTU-EN01, IFD9506, IFD9507, DVPSCM12-SL, DVPSCM52-SL) for WINDOWS operation system.

Description

The vulnerability is caused due to a boundary error in the processing of a project file, which can be exploited to cause a stack based buffer overflow when a user opens e.g. a specially crafted .DCI file. Successful exploitation allows execution of arbitrary code on the affected machine.

 (1554.1830): Access violation - code c0000005 (!!! second chance !!!)
 eax=00000001 ebx=0018f684 ecx=44444444 edx=777a4a20 esi=0018f65c edi=777a4a20
 eip=73d34b64 esp=0018cdd8 ebp=0018cdec iopl=0         nv up ei pl nz na po nc
 cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00010202
 MFC42!Ordinal2740+0x88:
 73d34b64 8b01            mov     eax,dword ptr [ecx]  ds:002b:44444444=????????
 0:000> d esp
 0018cdd8  1c f6 18 00 a8 a5 47 00-01 00 00 00 01 00 00 00  ......G.........
 0018cde8  5c f6 18 00 fc cd 18 00-a4 59 41 00 e1 b5 85 88  \........YA.....
 0018cdf8  5c f6 18 00 d8 f8 18 00-fa 38 41 00 84 f6 18 00  \........8A.....
 0018ce08  c8 8f 74 02 e8 1f 7c 02-04 ce 18 00 c8 8f 74 02  ..t...|.......t.
 0018ce18  04 ce 18 00 44 44 44 44-44 44 44 44 44 44 44 44  ....DDDDDDDDDDDD
 0018ce28  44 44 44 44 44 44 44 44-44 44 44 44 44 44 44 44  DDDDDDDDDDDDDDDD
 0018ce38  44 44 44 44 44 44 44 44-44 44 44 44 44 44 44 44  DDDDDDDDDDDDDDDD
 0018ce48  44 44 44 44 44 44 44 44-44 44 44 44 44 44 44 44  DDDDDDDDDDDDDDDD
 --
 (11bc.1394): Access violation - code c0000005 (first chance)
 First chance exceptions are reported before any exception handling.
 This exception may be expected and handled.
 Defaulted to export symbols for C:\Program Files (x86)\Delta Industrial Automation\Communication\DCISoft 1.12\MFC42.DLL -
 eax=0018cdfc ebx=0018f684 ecx=0018cdec edx=ce085164 esi=0018f65c edi=31f7ae9c
 eip=43434343 esp=0018cdcc ebp=0018cdec iopl=0         nv up ei pl nz ac pe cy
 cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00210217
 43434343 ??              ???

Proof of Concept

dcisoft_bof.pyTXT

Disclosure Timeline

13.11.2015Vulnerability discovered.

15.11.2015Contact with the vendor.

16.11.2015Vendor responds asking more details.

17.11.2015Sent details to the vendor.

20.11.2015Asked vendor for status update.

20.11.2015Vendor forwards details to developers.

05.12.2015Asked vendor for status update.

09.12.2015Vendor responds, working on the issue.

16.01.2016Asked vendor for status update.