BroadWin WebAccess Client 'bwocxrun.ocx ' Multiple Remote Vulnerabilities

Bugtraq ID:	49428
Class:	Boundary Condition Error
CVE:
Remote:	Yes
Local:	No
Published:	Sep 02 2011 12:00AM
Updated:	Oct 31 2011 07:53PM
Credit:	Luigi Auriemma
Vulnerable:	Advantech BroadWin WebAccess 7.0
Not Vulnerable:

BroadWin WebAccess Client 'bwocxrun.ocx ' Multiple Remote Vulnerabilities

BroadWin WebAccess Client is prone to multiple remote vulnerabilities, including:

1. A format-string vulnerability
2. Multiple memory corruption vulnerabilities

Attackers could exploit these issues to execute arbitrary code in the context of the application using the ActiveX control (typically Internet Explorer). Failed exploit attempts will likely result in denial-of-service conditions.

BroadWin WebAccess Client 7.0 is vulnerable; other verisons may also bea ffected.

BroadWin WebAccess Client 'bwocxrun.ocx ' Multiple Remote Vulnerabilities

The following proof of concept and exploit code is available:

• /data/vulnerabilities/exploits/bwocxrun_1.zip
• /data/vulnerabilities/exploits/49428.htm

BroadWin WebAccess Client 'bwocxrun.ocx ' Multiple Remote Vulnerabilities

Solution:
Currently, we are not aware of any vendor supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

BroadWin WebAccess Client 'bwocxrun.ocx ' Multiple Remote Vulnerabilities

References:

• BroadWin WebAccess Client format string and arbitrary memory corruption (Luigi Auriemma)
  
• Microsoft Knowledge Base Article 240797 (Microsoft)
  
• Webacess Client Homepage (Advantech)
  
• ICS-ALERT-11-245-01�?? MULTIPLE ACTIVEX VULNERABILITIES IN ADVANTECH BROADWIN WEBA (US-CERT)