IRAI AUTOMGEN 8.0.0.7 – Use-After-Free

• Exploit Database
• 112 阅读

• 作者： Luigi Auriemma
  日期： 2011-10-10
• 类别：

  • dos
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/17964/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91

  #######################################################################   Luigi Auriemma   Application:IRAI AUTOMGEN http://www.irai.com/a8e/ Versions: <= 8.0.0.7 (aka 8.022) Platforms:Windows Bug:use after free Exploitation: file Date: 10 Oct 2011 Author: Luigi Auriemma e-mail: aluigi@autistici.org web:aluigi.org     #######################################################################     1) Introduction 2) Bug 3) The Code 4) Fix     #######################################################################   =============== 1) Introduction ===============     From vendor&apos;s website: "Universal automation workshop Fonctionnalities : automation projects creation for PLC and microprocessors, SCADA, Web SCADA, 3D process simulation, etc."     #######################################################################   ====== 2) Bug ======     Use after free in the handling of project files containing some malformed fields like the size of the embedded zip archive or some counters that may allow code execution.   No additional research performed because it was only a quick test, the following are various examples of locations for the possible code execution:   00460ee6 8b01mov eax,dword ptr [ecx] 00460ee8 6a01push1 00460eea ff5004calldword ptr [eax+4]   005239ca 8b06mov eax,dword ptr [esi] 005239cc 8bcemov ecx,esi 005239ce ff5010calldword ptr [eax+10h]   0040d11b 8b16mov edx,dword ptr [esi] 0040d11d 6a00push0 0040d11f 50pusheax 0040d120 8bcemov ecx,esi 0040d122 ff9288000000calldword ptr [edx+88h]     #######################################################################   =========== 3) The Code ===========     http://aluigi.org/poc/automgen_1.zip https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/17964.zip     #######################################################################   ====== 4) Fix ======     No fix.     #######################################################################