RDM Embedded Lock Manager 'lm_tcp' Service Buffer Overflow Vulnerability

Bugtraq ID:	45245
Class:	Boundary Condition Error
CVE:
Remote:	Yes
Local:	No
Published:	Dec 07 2010 12:00AM
Updated:	Dec 15 2010 01:34PM
Credit:	Luigi Auriemma
Vulnerable:	Wonderware InBatch 9.0 SP1 Wonderware InBatch 9.0 Wonderware InBatch 8.1 Raima RDM Embedded 0
Not Vulnerable:

RDM Embedded Lock Manager 'lm_tcp' Service Buffer Overflow Vulnerability

RDM Embedded is prone to a buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied data. The issue affects the 'lm_tcp' service.

Successful exploits may allow an attacker to execute arbitrary code in the context of a user running an application that uses the affected library. Failed exploit attempts may crash the application, denying service to legitimate users.

The issue affects lm_tcp <= 9.0.0 0248.18.0.0; other versions may also be affected.

RDM Embedded Lock Manager 'lm_tcp' Service Buffer Overflow Vulnerability

The following proof-of-concept code is available:

• /data/vulnerabilities/exploits/45245.zip

RDM Embedded Lock Manager 'lm_tcp' Service Buffer Overflow Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

RDM Embedded Lock Manager 'lm_tcp' Service Buffer Overflow Vulnerability

References:

• ICSA-10-348-01�??WONDERWARE INBATCH AND I/A SERIES BATCH BUFFER OVERFLOW (ICS-CERT)
  
• Raima Homepage (Raima)
  
• Vulnerability Note VU#647928 (US-CERT)
  
• Wonderware InBatch Software Homepage (Wonderware)