CVE-2019-5185

{"id": "CVE-2019-5185", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.4, "accessVector": "LOCAL", "vectorString": "AV:L/AC:M/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 3.4, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.0, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.0}]}, "published": "2020-03-23T14:15:13.283", "references": [{"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2019-0966", "tags": ["Exploit", "Third Party Advisory"], "source": "talos-cna@cisco.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-787"}]}], "descriptions": [{"lang": "en", "value": "An exploitable stack buffer overflow vulnerability vulnerability exists in the iocheckd service \"I/O-Check\" functionality of WAGO PFC 200. An attacker can send a specially crafted packet to trigger the parsing of this cache file. At 0x1ea28 the extracted state value from the xml file is used as an argument to /etc/config-tools/config_interfaces interface=X1 state=<contents of state node> using sprintf(). The destination buffer sp+0x40 is overflowed with the call to sprintf() for any state values that are greater than 512-len(\"/etc/config-tools/config_interfaces interface=X1 state=\") in length. Later, at 0x1ea08 strcpy() is used to copy the contents of the stack buffer that was overflowed sp+0x40 into sp+0x440. The buffer sp+0x440 is immediately adjacent to sp+0x40 on the stack. Therefore, there is no NULL termination on the buffer sp+0x40 since it overflowed into sp+0x440. The strcpy() will result in invalid memory access. An state value of length 0x3c9 will cause the service to crash."}, {"lang": "es", "value": "Se presenta una vulnerabilidad de desbordamiento del b\u00fafer de la pila explotable en la funcionalidad \"I/O-Check\" del servicio iocheckd de WAGO PFC 200. Un atacante puede enviar un paquete especialmente dise\u00f1ado para activar el an\u00e1lisis de este archivo cach\u00e9. En 0x1ea28, el valor de estado extra\u00eddo del archivo xml es usado como un argumento para /etc/config-tools/config_interfaces interface=X1 state= usando la funci\u00f3n sprintf(). El b\u00fafer de destino sp+0x40 es desbordado con la llamada a la funci\u00f3n sprintf() para cualquier valor de estado que sea mayor de 512-len(\"/etc/config-tools/config_interfaces interface=X1 state=\") de longitud. M\u00e1s tarde, en 0x1ea08 la funci\u00f3n strcpy() es usada para copiar el contenido del b\u00fafer de la pila que se desbord\u00f3 sp+0x40 en sp+0x440. El b\u00fafer sp+0x440 est\u00e1 inmediatamente adyacente a sp+0x40 sobre la pila. Por lo tanto, no presenta terminaci\u00f3n NULL en el b\u00fafer sp+0x40 ya que se desbord\u00f3 en sp+0x440. La funci\u00f3n strcpy() resultar\u00e1 en un acceso no v\u00e1lido a la memoria. Un valor de estado de longitud 0x3c9 causar\u00e1 que el servicio se bloquee."}], "lastModified": "2021-07-21T11:39:23.747", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:wago:pfc200_firmware:03.02.02\\(14\\):*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6274B67D-C65B-4834-9DB5-6FB3D0ADD3A9"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:wago:pfc200:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "688A3248-7EAA-499D-A47C-A4D4900CDBD1"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "talos-cna@cisco.com"}