Advantech WebAccess CVE-2014-8388 Stack Based Buffer Overflow Vulnerability
BID:71193
Info
Advantech WebAccess CVE-2014-8388 Stack Based Buffer Overflow Vulnerability
| Bugtraq ID: | 71193 |
| Class: | Boundary Condition Error |
| CVE: |
CVE-2014-8388 |
| Remote: | Yes |
| Local: | No |
| Published: | Nov 19 2014 12:00AM |
| Updated: | Jul 15 2015 12:14AM |
| Credit: | Ricardo Narvaja from Core Security Consulting Services |
| Vulnerable: | |
| Not Vulnerable: | |
Discussion
Advantech WebAccess CVE-2014-8388 Stack Based Buffer Overflow Vulnerability
Advantech WebAccess is prone to a stack-based buffer-overflow vulnerability within the ActiveX control because the application fails to properly bounds-check user-supplied data before copying it into an insufficiently sized buffer.
Attackers can exploit this issue to execute arbitrary code in the context of the affected application (typically Internet Explorer) using the ActiveX control. Failed exploit attempts will likely result in denial-of-service conditions.
Advantech WebAccess 7.2 is vulnerable; other versions may also be affected.
Advantech WebAccess is prone to a stack-based buffer-overflow vulnerability within the ActiveX control because the application fails to properly bounds-check user-supplied data before copying it into an insufficiently sized buffer.
Attackers can exploit this issue to execute arbitrary code in the context of the affected application (typically Internet Explorer) using the ActiveX control. Failed exploit attempts will likely result in denial-of-service conditions.
Advantech WebAccess 7.2 is vulnerable; other versions may also be affected.
Exploit / POC
Advantech WebAccess CVE-2014-8388 Stack Based Buffer Overflow Vulnerability
An attacker can exploit these issues by enticing an unsuspecting user to view a malicious webpage.
The researcher has created a proof-of-concept to demonstrate the issue. Please see the references for more information.
Core Security Technologies has developed a working commercial exploit for its CORE IMPACT product. This exploit is not otherwise publicly available or known to be circulating in the wild.
An attacker can exploit these issues by enticing an unsuspecting user to view a malicious webpage.
The researcher has created a proof-of-concept to demonstrate the issue. Please see the references for more information.
Core Security Technologies has developed a working commercial exploit for its CORE IMPACT product. This exploit is not otherwise publicly available or known to be circulating in the wild.
Solution / Fix
Advantech WebAccess CVE-2014-8388 Stack Based Buffer Overflow Vulnerability
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.
References
Advantech WebAccess CVE-2014-8388 Stack Based Buffer Overflow Vulnerability
References:
References:
- Microsoft Support Document 240797 (Microsoft)