Advantech WebAccess CVE-2014-0768 Stack-Based Buffer Overflow Vulnerability

Bugtraq ID:	66732
Class:	Boundary Condition Error
CVE:	CVE-2014-0768
Remote:	Yes
Local:	No
Published:	Apr 08 2014 12:00AM
Updated:	Sep 03 2014 02:26PM
Credit:	Andrea Micalizzi, Tom Gallagher, and an independent anonymous researcher working with HP�??s Zero Day Initiative,ZDI.
Vulnerable:	Advantech BroadWin WebAccess 7.0
Not Vulnerable:

Advantech WebAccess CVE-2014-0768 Stack-Based Buffer Overflow Vulnerability

Advantech WebAccess is prone to a stack-based buffer-overflow vulnerability because the application fails to properly bounds-check user-supplied data before copying it into an insufficiently sized buffer.

Successful exploits may allow an attacker to execute arbitrary code with system privileges. Failed attempts will likely cause a denial-of-service condition.

Advantech WebAccess 7.1 and prior are vulnerable.

Advantech WebAccess CVE-2014-0768 Stack-Based Buffer Overflow Vulnerability

Core Security Technologies has developed a working commercial exploit for its CORE IMPACT product. This exploit is not otherwise publicly available or known to be circulating in the wild.

Advantech WebAccess CVE-2014-0768 Stack-Based Buffer Overflow Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Advantech WebAccess CVE-2014-0768 Stack-Based Buffer Overflow Vulnerability

References: