← Advisories

Netwrix Auditor 7.1.322.0 ActiveX (sourceFile) Stack Buffer Overflow Vulnerability

High
Advisory ID
ZSL-2016-5311
Release Date
15 March 2016
Vendor
Netwrix Corporation - http://www.netwrix.com
Affected Version
7.1 (Build 322)
CVE
N/A
Tested On
Microsoft Windows 7 Professional SP1 (EN), Microsoft Windows 7 Ultimate SP1 (EN)
Summary

Netwrix Auditor is an IT audit software that maximizes visibility of IT infrastructure changes and data access. The product provides actionable audit data about who changed what, when and where and who has access to what.

Description

The application suffers from a stack-based buffer overflow vulnerability when parsing large amount of bytes to the 'sourceFile' string parameter in PackFile() and UnpackFile() functions in 'Netwrix.Common.CollectEngine.dll' library, resulting in stack overrun overwriting several registers including the SEH chain. An attacker can gain access to the system of the affected node and execute arbitrary code.

STATUS_STACK_BUFFER_OVERRUN encountered (1fbc.1470): Break instruction exception - code 80000003 (first chance) eax=00000000 ebx=63d7e5b8 ecx=7693047c edx=0040db55 esi=00000000 edi=0072a4ac eip=7693025d esp=0040dd9c ebp=0040de18 iopl=0 nv up ei pl zr na pe nc cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00000246 kernel32!GetProfileStringW+0x12cc1: 7693025d cc int 3 -- (1a98.1c4): Access violation - code c0000005 (first chance) First chance exceptions are reported before any exception handling. This exception may be expected and handled. *** WARNING: Unable to verify checksum for C:\Program Files (x86)\Common Files\Netwrix Auditor\Event Collector\Netwrix.Common.CollectEngine.dll eax=00000041 ebx=000012b2 ecx=00350000 edx=00000020 esi=00762240 edi=0034dc7c eip=5dd16895 esp=0034d75c ebp=0034d778 iopl=0 nv up ei pl nz ac po cy cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010213 Netwrix_Common_CollectEngine!DllUnregisterServer+0x21725: 5dd16895 668901 mov word ptr [ecx],ax ds:002b:00350000=???? 0:000> !exchain 0034e51c: 00410041 Invalid exception stack at 00410041
Proof of Concept
Disclosure Timeline
07.12.2015Vulnerability discovered.
24.01.2016Vendor contacted.
14.03.2016No response from the vendor.
15.03.2016Public security advisory released.
16.03.2016Working with the vendor.
23.03.2016Vendor confirms the issue scheduling patch release date.
13.04.2016Vendor releases version 7.1 (Build 333) and 8.0 to address this issue.
Credits
Vulnerability discovered by Gjoko Krstic
References
Changelog
15.03.2016Initial release
16.03.2016Added reference [1], [2] and [3]
17.03.2016Added vendor status
30.03.2016Added vendor status and reference [4]
13.04.2016Added vendor status.