← Advisories

Operation Technology ETAP 14.1.0 Multiple Stack Buffer Overrun Vulnerabilities

High

Advisory ID

ZSL-2016-5324

Release Date

22 May 2016

Vendor

Operation Technology, Inc. - http://www.etap.com

Affected Version

14.1.0.0

CVE

N/A

Tested On

Microsfot Windows 7 Professional SP1 (EN) x86_64, Microsoft Windows 7 Ultimate SP1 (EN) x86_64

Summary

Enterprise Software Solution for Electrical Power Systems. ETAP is the most comprehensive electrical engineering software platform for the design, simulation, operation, and automation of generation, transmission, distribution, and industrial systems. As a fully integrated model-driven enterprise solution, ETAP extends from modeling to operation to offer a Real-Time Power Management System.

Description

Multiple ETAP binaries are prone to a stack-based buffer overflow vulnerability because the application fails to handle malformed arguments. An attacker can exploit these issues to execute arbitrary code within the context of the application or to trigger a denial-of-service conditions.

STATUS_STACK_BUFFER_OVERRUN encountered
(380c.3cc4): Break instruction exception - code 80000003 (first chance)
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\windows\system32\kernel32.dll -
*** WARNING: Unable to verify checksum for SO3Ph.exe
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for SO3Ph.exe -
kernel32!UnhandledExceptionFilter+0x71:
00000000`76fcb8c1 cc              int     3
0:000> r
rax=0000000000000000 rbx=0000000000000000 rcx=000063dde1df0000
rdx=000000000000fffd rsi=0000000000000001 rdi=0000000000000002
rip=0000000076fcb8c1 rsp=00000000000fe780 rbp=ffffffffffffffff
 r8=0000000000000000  r9=0000000000000000 r10=0000000000000000
r11=00000000000fe310 r12=0000000140086150 r13=0000000000000000
r14=000000000012eb00 r15=0000000000000000
iopl=0         nv up ei pl nz na po nc
cs=0033  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00000206
kernel32!UnhandledExceptionFilter+0x71:
00000000`76fcb8c1 cc              int     3

Proof of Concept

etap_bof.txtTXT

Disclosure Timeline

07.04.2016Vulnerabilities discovered.

11.04.2016Vendor contacted.

21.05.2016No response from the vendor.

22.05.2016Public security advisory released.

Credits

Vulnerability discovered by Gjoko Krstic

References

[1]https://cxsecurity.com/issue/WLB-2016050107

[2]https://www.exploit-db.com/exploits/39846/