SolarWinds Dameware DoS

When the DWRCS.exe 'Allow only FIPS Mode' setting is enabled, DWRCRSA.dll is loaded to perform ECDH key exchange. During the key exchange, the client signs the ECDH shared secret with an EC private key and sends the server both the signature and the EC public key so that the server can verify the signature. Inside the key exchange message, an unauthenticated, remote attacker can specify a large 'SigPubkeyLen' field (i.e., 0x1fffff) to cause a buffer over-read/over-write condition in DWRCRSA.dll:

.text:100026E4      mov     edi, [esp+343Ch+msg.SigPubkeyLen] ; attacker-controlled
.text:100026EB      push    edi    ; size_t
.text:100026EC      lea     eax, [esp+3440h+msg.SigPubkey] ; stack buffer; received msg
.text:100026F3      push    eax    ; void *
.text:100026F4      lea     ecx, [esi+OBJ_205C.SigPubkey] ; heap buffer
.text:100026FA      push    ecx    ; void *
.text:100026FB      call    _memcpy

The key exchange msg has the following format:

// used for DH/ECDH key exchange
// msg_len: 0x2c2c
// le = little endian
struct msg_000105b9
{
	le32 MsgType;	// must be 0x000105b9
	byte unk[4];
	le32 status;   // 0 - no error
	byte msg[0x1000]; 	// error msg
	byte SrvPubKey[0x400];
	le32 SrvPubKeyLen;
	le32 CltSharedSecretLen;    // length of client-computed DH/ECDH shared secret
	le32 CltSharedSecretByteSum;// client-computed sum of all bytes in the secret
	byte CltPubKey[0x400];
	le32 CltPubKeyLen;
	le32 SrvSharedSecretLen; // length of server-computed DH/ECDH shared secret
	le32 SrvSharedSecretByteSum;// server-computed sum of all bytes in the secret
	byte Signature[0x800];	// client-generated signature of the shared secret
	le32 SignaturLen;
	byte SigPubkey[0x800];	// public key to verify the signature
	le32 SigPubkeyLen;
	byte unk[0x400];
};

If the msg.SigPubkeyLen field is greater than 0x800, it can cause a buffer over-read on the stack buffer msg.SigPubkey and a buffer over-write on the 0x800-byte SigPubkey local buffer located at offset 0x143c of a 0x205c-byte structure on the heap.

The attached PoC can be used to terminate DWRCS.exe:

python dameware_dwrcrsa_sigpubkey_bof.py -t  -p 6129

https://github.com/tenable/poc/blob/master/Solarwinds/Dameware/dameware_dwrcrsa_sigpubkey_bof.py