Facebook Google Plus Twitter LinkedIn YouTube RSS Menu Search Resource - BlogResource - WebinarResource - ReportResource - Eventicons_066 icons_067icons_068icons_069icons_070

CODESYS V3 Unauthenticated Remote Heap Buffer Overflow

Critical

Synopsis

CVE-2019-18858: Unauthenticated Remote Heap Buffer Overflow

While developing a Nessus plugin to detect CVE-2019-13548, Tenable found an unauthenticated remote heap buffer overflow vulnerability in CODESYS V3 runtime component CmpWebServerHandlerV3. The flaw exists in CmpWebServerHandlerV3.dll (file version 3.5.15.0) due to improper validation of user-supplied data sent to the CODESYS V3 web server URL endpoint /WebVisuV3.

The following code snippet shows the vulnerability:

.text:1000306D      call    HandleVisuService
.text:10003073      add     esp, 14h
.text:10003076      mov     [ebp+rc], eax
.text:10003079      mov     eax, [ebp+HdrSizePlus4]    ; attacker-controlled size
.text:1000307C      push    eax
.text:1000307D      mov     ecx, [ebp+pbData]          ; attacker-controlled data
.text:10003080      push    ecx
.text:10003081      mov     edx, [ebp+pbCommBuf]       ; heap buffer allocation size can
.text:10003081                                         ; be controlled by the attacker
.text:10003084      push    edx
.text:10003085      call    memcpy

The attacker sends a WEB_CLIENT_OPENCONNECTION HTTP message to control the allocation size of a heap buffer pointed by pbCommBuf. He or she then sends a WEB_CLIENT_RUN_SERVICE HTTP message to cause a memcpy operation with source data contents and length controlled by the attacker. This could cause a heap buffer overflow condition. The following shows 0x1004-bytes of attacker-controlled data is being copied to a heap buffer of a few bytes:

0:015> kb
 # ChildEBP RetAddr  Args to Child              
WARNING: Stack unwind information not available. Following frames may be wrong.
00 0420fe5c 01a71464 01a78110 00000002 003c68d0 CmpWebServerHandlerV3!ComponentEntry+0x13d5
01 0420fea4 01a34ea3 01a4f568 00000000 00000000 CmpWebServerHandlerV3+0x1464
02 0420fed4 01a35788 01a4f568 00001018 00000000 CmpWebServer!ComponentEntry+0x3c63
03 0420fefc 01a34a20 01a4f568 0420ff44 01a342c4 CmpWebServer!ComponentEntry+0x4548
04 0420ff08 01a342c4 01a4f568 01a4f558 01a4f558 CmpWebServer!ComponentEntry+0x37e0
05 0420ff44 01a32cbe 0420ff88 005f41c8 00980f44 CmpWebServer!ComponentEntry+0x3084
06 0420ff4c 005f41c8 00980f44 7259102a 00000000 CmpWebServer!ComponentEntry+0x1a7e
07 0420ff88 77e2efac 00980f38 0420ffd4 77f23618 CODESYSControlService+0x1f41c8
08 0420ff94 77f23618 00980f38 73db7c92 00000000 kernel32!BaseThreadInitThunk+0xe
09 0420ffd4 77f235eb 005f4170 00980f38 00000000 ntdll!__RtlUserThreadStart+0x70
0a 0420ffec 00000000 005f4170 00980f38 00000000 ntdll!_RtlUserThreadStart+0x1b
0:015> r
eax=00001004 ebx=00980f38 ecx=021566b4 edx=003be738 esi=00000000 edi=00000000
eip=01a73085 esp=0420fe00 ebp=0420fe5c iopl=0         nv up ei pl nz na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000206
CmpWebServerHandlerV3!ComponentEntry+0x13d5:
01a73085 e8f21e0000      call    CmpWebServerHandlerV3!ComponentEntry+0x32cc (01a74f7c)
0:015> dd esp L3
0420fe00  003be738 021566b4 00001004
0:015> !heap -p -a 003be738 
    address 003be738 found in
    _HEAP @ 2d0000
      HEAP_ENTRY Size Prev Flags    UserPtr UserSize - state
        003be6d8 000d 0000  [00]   003be6e0    0005d - (busy)

 
0:015> db 021566b4 L1004
021566b4  50 50 00 10 04 00 01 00-00 00 00 00 ff ff ff 07  PP..............
021566c4  00 00 00 00 41 41 41 41-41 41 41 41 41 41 41 41  ....AAAAAAAAAAAA
021566d4  41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41  AAAAAAAAAAAAAAAA
...
021576a4  41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41  AAAAAAAAAAAAAAAA
021576b4  41 41 41 41                                      AAAA

Solution

Upgrade to V3.5.15.20.

Proof of Concept

https://github.com/tenable/poc/blob/master/codesys/codesys_v3_webserver_heap_overflow.py

Disclosure Timeline

09/25/2019 - Vulnerability discovered
10/16/2019 - Disclosed to [email protected] 90 day is Jan 14, 2020.
10/17/2019 - CODESYS acknowledges. Asks who to credit should an advisory be released.
10/17/2019 - Tenable indicates, "Tenable, Inc."
10/31/2019 - CODESYS is working on a fix and plans to provide a patch and advisory at the end of November. They will inform us once the advisory is available.
11/20/2019 - CODESYS informs us that they released a fix and an advisory.
11/20/2019 - Tenable thanks CODESYS and provides a link to our advisory.

All information within TRA advisories is provided “as is”, without warranty of any kind, including the implied warranties of merchantability and fitness for a particular purpose, and with no guarantee of completeness, accuracy, or timeliness. Individuals and organizations are responsible for assessing the impact of any actual or potential security vulnerability.

Tenable takes product security very seriously. If you believe you have found a vulnerability in one of our products, we ask that you please work with us to quickly resolve it in order to protect customers. Tenable believes in responding quickly to such reports, maintaining communication with researchers, and providing a solution in short order.

For more details on submitting vulnerability information, please see our Vulnerability Reporting Guidelines page.

If you have questions or corrections about this advisory, please email [email protected]

Try for Free Buy Now

Try Tenable.io

FREE FOR 30 DAYS

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy. Sign up now.

Buy Tenable.io

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy. Purchase your annual subscription today.

65 assets

$2,275

Buy Now

Try for Free Buy Now

Try Nessus Professional Free

FREE FOR 7 DAYS

Nessus® is the most comprehensive vulnerability scanner on the market today. Nessus Professional will help automate the vulnerability scanning process, save time in your compliance cycles and allow you to engage your IT team.

Buy Nessus Professional

Nessus® is the most comprehensive vulnerability scanner on the market today. Nessus Professional will help automate the vulnerability scanning process, save time in your compliance cycles and allow you to engage your IT team.

Buy a multi-year license and save. Add Advanced Support for access to phone, email, community and chat support 24 hours a day, 365 days a year. Full details here.

Try for Free Buy Now

Try Tenable.io Web Application Scanning

FREE FOR 30 DAYS

Enjoy full access to our latest web application scanning offering designed for modern applications as part of the Tenable.io platform. Safely scan your entire online portfolio for vulnerabilities with a high degree of accuracy without heavy manual effort or disruption to critical web applications. Sign up now.

Buy Tenable.io Web Application Scanning

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy. Purchase your annual subscription today.

5 FQDNs

$3,578

Buy Now

Try for Free Contact Sales

Try Tenable.io Container Security

FREE FOR 30 DAYS

Enjoy full access to the only container security offering integrated into a vulnerability management platform. Monitor container images for vulnerabilities, malware and policy violations. Integrate with continuous integration and continuous deployment (CI/CD) systems to support DevOps practices, strengthen security and support enterprise policy compliance.

Buy Tenable.io Container Security

Tenable.io Container Security seamlessly and securely enables DevOps processes by providing visibility into the security of container images – including vulnerabilities, malware and policy violations – through integration with the build process.

Learn More about Industrial Security

Get a Demo of Tenable.sc

Please fill out the form below with your contact information and a sales representative will contact you shortly to schedule a demo. You may also include a short comment (limited to 255 characters). Please note that fields with asterisks (*) are mandatory.

Try for Free Contact Sales

Try Tenable Lumin

FREE FOR 30 DAYS

Visualize and explore your Cyber Exposure, track risk reduction over time and benchmark against your peers with Tenable Lumin.

Buy Tenable Lumin

Contact a Sales Representative to see how Lumin can help you gain insight across your entire organization and manage cyber risk.