Advantech WebAccess CVE-2014-0985 Incomplete Fix Stack Based Buffer Overflow Vulnerability

Bugtraq ID:	69529
Class:	Boundary Condition Error
CVE:	CVE-2014-0985
Remote:	Yes
Local:	No
Published:	Sep 01 2014 12:00AM
Updated:	Sep 22 2014 06:05PM
Credit:	Ricardo Narvaja
Vulnerable:
Not Vulnerable:

Advantech WebAccess CVE-2014-0985 Incomplete Fix Stack Based Buffer Overflow Vulnerability

Advantech WebAccess is prone to a stack-based buffer-overflow vulnerability because the application fails to properly bounds-check user-supplied data before copying it into an insufficiently sized buffer.

Note: Specifically, the vulnerability exists due to incomplete fix for CVE-2014-0764 (BID 66718 - Advantech WebAccess CVE-2014-0764 Stack-Based Buffer Overflow Vulnerability).

Attackers can exploit this issue to execute arbitrary code within the context of the application. Failed exploit attempts will likely cause a denial-of-service condition.

Advantech WebAccess 7.2 is vulnerable; other versions may also be affected.

Advantech WebAccess CVE-2014-0985 Incomplete Fix Stack Based Buffer Overflow Vulnerability

Core Security Technologies has developed a working commercial exploit for its CORE IMPACT product. This exploit is not otherwise publicly available or known to be circulating in the wild.

Advantech WebAccess CVE-2014-0985 Incomplete Fix Stack Based Buffer Overflow Vulnerability

References:

• Advantech WebAccess Homepage (Advantech)
  
• Advantech WebAccess Vulnerabilities (Advantech)
  
• Advisory (ICSA-14-261-01) Advantech WebAccess Vulnerabilities (CERT)