bugtraq - BufferOverflow Vulnerability on Logica HotScan SWIFT Alliance Access Interface

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <CA+PFrLkE5Z_oy=wxR4b9nhNo8=+B_dxaWLG2WGOuA3_1Lr7y-w@mail.gmail.com>
Date: Tue, 9 Oct 2012 16:59:24 +0200
From: Anil Pazvant <pazwant@...il.com>
To: bugtraq@...urityfocus.com
Subject: BufferOverflow Vulnerability on Logica HotScan SWIFT Alliance Access Interface

--------------------------------------------------------------------------------

| BufferOverflow Vulnerability on Logica HotScan SWIFT Alliance Access Interface

--------------------------------------------------------------------------------

Summary

=======

Hotscan Listener interface is prone to buffer-overflow vulnerability
because the application fails to perform adequate boundary checks on
user-supplied input. This allows remote attackers to cause a denial of
service (crash) and possibly execute arbitrary code via a crafted font
file

CVE number: CVE-2012-2624

Impact: Critical

Vendor notified: May 11, 2012

Vendor response: Vendor patched the vulnerability ( June 16, 2012 )

.

Affected Products

======== ========

Logica HotScan Interface

Details

=======

By sending malicious input to hotscan listener  tcp interface, it is
possible to overwrite stack only  by  two bytes. The software compiled
with NXCOMPAT,Code execution could not be done. Therefore crash of
this service can stop all swift process , this effects the impact of
vulnerability.

(Register output:
ECX 76E801B8 ASCII "STATUS_STACK_BUFFER_OVERRUN encountered"
EDX 0018F325 ASCII 0A,"STATUS_STA"
EBX 0042AEAC HOTS_Rec.0042AEAC
ESP 0018F56C
EBP 0018F5E8
ESI 00000000
EDI 00000000
EIP 76E7FF9A kernel32.76E7FF9A

Solution

========

Vendor released a patch to fix the bug.