CVE-2011-3322: Procyon Core Server HMI Coreservice.exe Remote Stack Buffer Overflow

Key Information Vulnerability Details Vulnerability Name: Procyon Core Server HMI <= v1.13 Coreservice.exe Stack Buffer Overflow Disclosure Date: 2011.09.17 Source: exploit-db Risk Level: High Local Vulnerability: No Remote Vulnerability: Yes CVE ID: CVE-2011-3322 CWE ID: CWE-119 CVSS Score CVSS Base Score: 10/10 Attack Complexity: Low Attack Vector: Remote Confidentiality Impact: Complete Integrity Impact: Complete Availability Impact: Complete Authentication: None required Exploitability Subscore: 10/10 Vulnerability Description stratsec has identified a remote stack overflow vulnerability in the Procyon Core Server HMI service, which can be triggered by sending a specially crafted request to port 23. This vulnerability allows for direct remote code execution with elevated privileges. Failed attempts may result in a denial-of-service condition. Impact Remote attackers can exploit this vulnerability to execute arbitrary code remotely and gain elevated privileges. Technical Details A memory corruption vulnerability exists in the [Coreservice.exe] process, allowing attackers to perform arbitrary read and write operations. The stack overflow can be triggered by sending a long password request. Affected Products Procyon Core Server v1.06 is confirmed to be affected; other versions may also be vulnerable. Proof of Concept Commercial-grade PoC exploits have been developed and are available in Metasploit. Solution Upgrade to Procyon Core Server version 1.14. Timeline July 19, 2011: Vendor notified July 19, 2011: Vendor confirmed the issue July 20, 2011: stratsec contacted Nsense research team July 20, 2011: Contacted US Department of Homeland Security ICS-CERT for confirmation September 8, 2011: Public announcement released

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2011-3322: Procyon Core Server HMI Coreservice.exe Remote Stack Buffer Overflow