Survey ForeControl v3.5.1 sp4 Vulnerability Analysis: Stack Overflow, Directory Traversal, ActiveX RCE

Critical Vulnerability Information 1. Vulnerability Overview Application: Survey ForeControl (http://www.forecontrol.com/cn/prod.asp) Version: v3.5.1 sp4 with AngelServer and WebServer included Date: May 22, 2012 Author: c mill 2. Vulnerability Details Type: Multiple stack overflows, WebServer directory traversal, AngelServer service crash, AngelServer third-party ActiveX code execution, WebServer arbitrary file read Impact: May lead to remote code execution and server compromise 3. Specific Vulnerability Descriptions a) AngelServer Stack Overflow - A signed comparison in package B of AngelServer causes a stack overflow. - Includes detailed assembly code analysis. b) WebServer Directory Traversal - Files under the project root directory can be downloaded using the pattern. c) AngelServer Service Crash - The AngelServer program is affected by various issues, potentially leading to: - Exception handler failure due to inaccessible memory in process G. - Invalid memory read in process G when sending data via socket t. - Exception loss in process G when receiving data via socket s. d) Third-Party ActiveX Code Execution - The software bundles Cold Software’s WMPAS.ocx ActiveX control, which may be exploited to bypass exception handlers. e) Stack Overflow in SMTP No-DISARM - Stack overflow caused by data block copying in stack buffer. f) Stack Overflow in SNMP No-DISARM - Stack overflow due to use-after-free variable. g) WebServer Arbitrary File Read - Any file or directory on any disk can be read. - A very limited heap overflow exists, but only affects Service A files. 4. POC (Proof of Concept) Provides POC code examples for different vulnerabilities.

Goal Reached Thanks to every supporter — we hit 100%!

Survey ForeControl v3.5.1 sp4 Vulnerability Analysis: Stack Overflow, Directory Traversal, ActiveX RCE