CVE-2019-5185

An exploitable stack buffer overflow vulnerability vulnerability exists in the iocheckd service "I/O-Check" functionality of WAGO PFC 200. An attacker can send a specially crafted packet to trigger the parsing of this cache file. At 0x1ea28 the extracted state value from the xml file is used as an argument to /etc/config-tools/config_interfaces interface=X1 state=<contents of state node> using sprintf(). The destination buffer sp+0x40 is overflowed with the call to sprintf() for any state values that are greater than 512-len("/etc/config-tools/config_interfaces interface=X1 state=") in length. Later, at 0x1ea08 strcpy() is used to copy the contents of the stack buffer that was overflowed sp+0x40 into sp+0x440. The buffer sp+0x440 is immediately adjacent to sp+0x40 on the stack. Therefore, there is no NULL termination on the buffer sp+0x40 since it overflowed into sp+0x440. The strcpy() will result in invalid memory access. An state value of length 0x3c9 will cause the service to crash.

• CVE ID
• CVE-2019-5185

• Assigner
• talos-cna@cisco.com

• Vulnerability Status
• Analyzed

• Published Version
• 2020-03-23T14:15:13

• Last Modified Date
• 2021-07-21T11:39:23

• Version
• 2.0

• Vector String
• AV:L/AC:M/Au:N/C:P/I:P/A:P

• Access Vector
• LOCAL

• Access Compatibility
• MEDIUM

• Authentication
• NONE

• Confidentiality Impact
• PARTIAL

• Integrity Impact
• PARTIAL

• Availability Impact
• PARTIAL

• Base Score
• 4.4

• Severity
• MEDIUM

• Exploitability Score
• 3.4

• Impact Score
• 6.4

• Version
• 3.1

• Vector String
• CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

• Attack Vector
• LOCAL

• Attack Compatibility
• HIGH

• Privileges Required
• LOW

• User Interaction
• NONE

• Scope
• UNCHANGED

• Confidentiality Impact
• HIGH

• Availability Impact
• HIGH

• Base Score
• 7

• Base Severity
• HIGH

• Exploitability Score
• 1

• Impact Score
• 5.9