X41 D-Sec GmbH Security Advisory X41-2020-006: Memory Corruption Vulnerability in bspatch
X41 D-Sec GmbH Advisories <[email protected]> Thu, 9 Jul 2020 18:42:53 +0200
| Newsgroups | gmane.comp.security.fulldisclosure,gmane.comp.security.bugtraq |
|---|---|
| Message-ID | <[email protected]> |
LS0tLS1CRUdJTiBQR1AgU0lHTkVEIE1FU1NBR0UtLS0tLQpIYXNoOiBTSEE1MTIKCgpYNDEgRC1T RUMgR21iSCBTZWN1cml0eSBBZHZpc29yeTogWDQxLTIwMjAtMDA2CgpBZHZpc29yeSBYNDEtMjAy MC0wMDY6IE1lbW9yeSBDb3JydXB0aW9uIFZ1bG5lcmFiaWxpdHkgaW4gYnNwYXRjaAo9PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PQpTZXZlcml0eSBSYXRpbmc6IEhpZ2gKQ29uZmlybWVkIEFmZmVjdGVkIFZlcnNpb25zOiBDb2xp biBQZXJjaXZhbCdzIGJzZGlmZiA0LjMKQ29uZmlybWVkIFBhdGNoZWQgVmVyc2lvbnM6IEZyZWVC U0QncyBic2RpZmYKKGh0dHBzOi8vc3Zud2ViLmZyZWVic2Qub3JnL2Jhc2UvaGVhZC91c3IuYmlu L2JzZGlmZi9ic3BhdGNoL2JzcGF0Y2guYykKVmVuZG9yOiBDb2xpbiBQZXJjaXZhbApWZW5kb3Ig VVJMOiBodHRwczovL3d3dy5kYWVtb25vbG9neS5uZXQvYnNkaWZmLwpWZW5kb3IgUmVmZXJlbmNl OiBOb25lClZlY3RvcjogUGF0Y2ggZmlsZQpDcmVkaXQ6IFg0MSBELVNFQyBHbWJILCBMdWlzIE1l cmlubwpTdGF0dXM6IFB1YmxpYwpDVkU6IENWRS0yMDIwLTE0MzE1CkNXRTogMTE5CkNWU1MgU2Nv cmU6IE4vQQpDVlNTIFZlY3RvcjogTi9BCkFkdmlzb3J5LVVSTDogaHR0cHM6Ly93d3cueDQxLWRz ZWMuZGUvbGFiL2Fkdmlzb3JpZXMveDQxLTIwMjAtMDA2LWJzcGF0Y2gvCgpTdW1tYXJ5IGFuZCBJ bXBhY3QKPT09PT09PT09PT09PT09PT09CkEgbWVtb3J5IGNvcnJ1cHRpb24gdnVsbmVyYWJpbGl0 eSBpcyBwcmVzZW50IGluIGJzcGF0Y2ggYXMgc2hpcHBlZCBpbgpDb2xpbiBQZXJjaXZhbOKAmXMg YnNkaWZmIHRvb2xzIHZlcnNpb24gNC4zLiBJbnN1ZmZpY2llbnQgY2hlY2tzIHdoZW4KaGFuZGxp bmcgZXh0ZXJuYWwgaW5wdXRzIGFsbG93cyBhbiBhdHRhY2tlciB0byBieXBhc3MgdGhlIHNhbml0 eQpjaGVja3MgaW4gcGxhY2UgYW5kIHdyaXRlIG91dCBvZiBhIGR5bmFtaWNhbGx5IGFsbG9jYXRl ZCBidWZmZXIKYm91bmRhcmllcy4KCkV2ZW4gdGhvdWdoIHRoZSBwYXRjaGluZyBwcm9jZWR1cmUg aXMgdXN1YWxseSBjb21iaW5lZCB3aXRoIGludGVncml0eQphbmQgYXV0aGVudGljaXR5IGNoZWNr cywgYW4gYXR0YWNrZXIgdGhhdCBpcyBhYmxlIHRvIGRlbGl2ZXIgYQptYWxpY2lvdXMgcGF0Y2gg Y2FuIGNhdXNlIGhlYXAgY29ycnVwdGlvbiBpbiB0aGUgcHJvY2VzcyBydW5uaW5nCmJzcGF0Y2gg Y29kZSwgd2hlbiB0aGUgYXV0aGVudGljaXR5IGNoZWNrcyBoYXBwZW4gYWZ0ZXIgYXBwbHlpbmcg dGhlCnBhdGNoZXMuIERlcGVuZGluZyBvbiB0aGVpciBhYmlsaXR5IHRvIGNvbnRyb2wgYW5kIHNo YXBlIHRoZSBoZWFwCnN0YXRlIGJlZm9yZSBhbmQgZHVyaW5nIHRoZSBwcm9jZXNzaW5nIG9mIGEg bWFsaWNpb3VzIHBhdGNoIGZpbGUsCnJlbW90ZSBjb2RlIGV4ZWN1dGlvbiBtYXkgYmUgYWNoaWV2 ZWQuIFRoaXMgaGFzIGFscmVhZHkgYmVlbgpkZW1vbnN0cmF0ZWQKKGh0dHBzOi8vZ2lzdC5naXRo dWIuY29tL2Fub255bW91cy9lNDgyMDliMDNmMWRkOTYyNWE5OTI3MTdlN2I4OWM0ZiNmaWxlLWZy ZWVic2QtdHh0LUwxMTkyKQphcyBhIHByb29mLW9mLWNvbmNlcHQgZXhwbG9pdCBpbiAyMDE2IGJ5 IGFuIGFub255bW91cyBhdXRob3IgYWdhaW5zdAp0aGUgRnJlZUJTRCBic3BhdGNoIGltcGxlbWVu dGF0aW9uIG9uIDMyYml0IGFyY2hpdGVjdHVyZXMuCgpUaGlzIGlzc3VlIHdhcyBpbml0aWFsbHkg cmVwb3J0ZWQgZm9yIGJzcGF0Y2ggaW4gYnNkaWZmIOKAnGFzIHVzZWQgaW4KQXBwbGUgT1MgWCBi ZWZvcmUgMTAuMTEuNiBhbmQgb3RoZXIgcHJvZHVjdHPigJ0gd2l0aCBDVkUtMjAxNC05ODYyIGJ5 IGFuCmFub255bW91cyByZXNlYXJjaGVyIGFuZCB3YXMgcGFydGlhbGx5IGFkZHJlc3NlZCBieSBz ZXZlcmFsIHByb2plY3RzLAppbmNsdWRpbmcgQW5kcm9pZAooaHR0cHM6Ly9hbmRyb2lkLmdvb2ds ZXNvdXJjZS5jb20vcGxhdGZvcm0vZXh0ZXJuYWwvYnNkaWZmLysvNGQwNTQ3OTViNjczODU1ZTNh NzU1NmM2ZjJmN2FiOTljYTUwOTk5OCU1RSUyMS8jRjApLApDaHJvbWl1bU9TCihodHRwczovL2J1 Z3MuY2hyb21pdW0ub3JnL3AvY2hyb21pdW0vaXNzdWUvZGV0YWlsP2lkPTM3MjUyNSkgYW5kCkZy ZWVCU0QKKGh0dHBzOi8vd3d3LmZyZWVic2Qub3JnL3NlY3VyaXR5L2Fkdmlzb3JpZXMvRnJlZUJT RC1TQS0xNjoyNS5ic3BhdGNoLmFzYykKZHVyaW5nIDIwMTYuIFRoaXMgaW5pdGlhbCBiYXRjaCBv ZiBmaXhlcyBwcmV2ZW50ZWQgdGhlIGF0dGFjayB2aWEKbmVnYXRpdmUgY29udHJvbCB2YWx1ZXMu CgpOZXZlcnRoZWxlc3MsIGh1Z2UgY29udHJvbCB2YWx1ZXMgdGhhdCB3b3VsZCBpbnRlZ2VyIG92 ZXJmbG93IHRoZQpzYW5pdHkgY2hlY2tzIGFuZCBhbGxvdyBhbiBhdHRhY2tlciB3cml0aW5nIG91 dCBvZiBib3VuZHMgd2VyZSBub3QKZml4ZWQuIEEgc3Vic2VxdWVudCBwYXRjaCB3YXMgcmVsZWFz ZWQgYnkgRnJlZUJTRAooaHR0cHM6Ly93d3cuZnJlZWJzZC5vcmcvc2VjdXJpdHkvYWR2aXNvcmll cy9GcmVlQlNELVNBLTE2OjI5LmJzcGF0Y2guYXNjKQphZGRyZXNzaW5nIHRoZSByZW1haW5pbmcg aXNzdWVzIHRvZ2V0aGVyIHdpdGggYWRkaXRpb25hbCBoYXJkZW5pbmcuClVuZm9ydHVuYXRlbHks IG1vc3Qgb2YgYnNwYXRjaCBjb3BpZXMgZGlkbuKAmXQgcG9ydCB0aGlzIGZpeC4KCkl0IGlzIHdv cnRoIG1lbnRpb25pbmcgdGhhdCBic2RpZmYgNC4zLCBhcyBob3N0ZWQgYXQgQ29saW4gUGVyY2l2 YWzigJlzCmJzZGlmZiB3ZWJzaXRlIGh0dHBzOi8vd3d3LmRhZW1vbm9sb2d5Lm5ldC9ic2RpZmYv LCBzdGlsbCBzaGlwcyBhIGNvcHkKb2YgYnNwYXRjaC5jIHZ1bG5lcmFibGUgdG8gdGhlc2UgaXNz dWVzIHZpYSBib3RoIG5lZ2F0aXZlIGFuZCBodWdlCmNvbnRyb2wgdmFsdWVzLiBBbGwgdGhlIExp bnV4IGRpc3RyaWJ1dGlvbnMgd2UgaGF2ZSBjaGVja2VkIHNoaXBwaW5nCmJzZGlmZiBhcmUgYnVp bGRpbmcgZnJvbSB0aGlzIHNvdXJjZXMsIHdpdGggc29tZSBvZiB0aGVtIGFwcGx5aW5nIHRoZQpw YXJ0aWFsIGZpeCBpbml0aWFsbHkgcmVsZWFzZWQuCgpQcm9kdWN0IERlc2NyaXB0aW9uCj09PT09 PT09PT09PT09PT09PT0KYnNkaWZmIGFuZCBic3BhdGNoIGFyZSB0b29scyBmb3IgYnVpbGRpbmcg YW5kIGFwcGx5aW5nIHBhdGNoZXMgdG8KYmluYXJ5IGZpbGVzLiBUaGV5IHByb3ZpZGUgYW4gZWZm aWNpZW50IHdheSB0byBhcHBseSBiaW5hcnkgcGF0Y2hlcwpmb3IgYXBwbGljYXRpb25zIHVwZGF0 ZSBtZWNoYW5pc21zLgoKQW5hbHlzaXMKPT09PT09PT0KSW5zdWZmaWNpZW50IGNoZWNrcyB3aGVu IGNhbGN1bGF0aW5nIHRoZSBidWZmZXIgb2Zmc2V0IGFuZCBzaXplIG9mCndyaXRlIG9wZXJhdGlv bnMgYWxsb3dzIHdyaXRpbmcgb3V0IG9mIGEgaGVhcCBhbGxvY2F0ZWQgYnVmZmVyIGJvdW5kYXJp ZXMuCgotIC0KLSAtCi0KLS0tLS0tLS0tLS0tLS0tLS0tODwtLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0KICAgIHdoaWxlKG5ld3BvczxuZXdz aXplKSB7CiAgICAgICAgLyogUmVhZCBjb250cm9sIGRhdGEgLwogICAgICAgIGZvcihpPTA7aTw9 MjtpKyspIHsKICAgICAgICAgICAgbGVucmVhZCA9IEJaMmJ6UmVhZCgmY2J6MmVyciwgY3BmYnoy LCBidWYsIDgpOwogICAgICAgICAgICBpZiAoKGxlbnJlYWQgPCA4KSB8fCAoKGNiejJlcnIgIT0g QlpPSykgJiYKICAgICAgICAgICAgICAgIChjYnoyZXJyICE9IEJaU1RSRUFNRU5EKSkpCiAgICAg ICAgICAgICAgICBlcnJ4KDEsICJDb3JydXB0IHBhdGNoXG4iKTsKICAgICAgICAgICAgY3RybFtp XT1vZmZ0aW4oYnVmKTsKICAgICAgICB9OwogICAgICAgIC8gU2FuaXR5LWNoZWNrICovCiAgICAg ICAgaWYobmV3cG9zK2N0cmxbMF0+bmV3c2l6ZSkKICAgICAgICAgICAgZXJyeCgxLCJDb3JydXB0 IHBhdGNoXG4iKTsKICAgIC8qIFJlYWQgZGlmZiBzdHJpbmcgKi8KICAgIGxlbnJlYWQgPSBCWjJf YnpSZWFkKCZkYnoyZXJyLCBkcGZiejIsIG5ldyArIG5ld3BvcywgY3RybFswXSk7Ci0gLQotIC0K LQotLS0tLS0tLS0tLS0tLS0tLS04PC0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLQoKV2hlbiBjdHJsWzBdIHRha2VzIGVpdGhlciBuZWdhdGl2 ZSB2YWx1ZXMgb3IgYmlnIGVub3VnaCB2YWx1ZXMgdG8Kb3ZlcmZsb3cgbmV3cG9zK2N0cmxbMF0s IHRoZSBzYW5pdHkgY2hlY2sgaW4gcGxhY2Ugd2lsbCBwYXNzIGFsbG93aW5nCm9wZXJhdGlvbnMg dGhhdCB3cml0ZSBvdXQgb2YgYnVmZmVyIG5ldyBib3VuZGFyaWVzIHZpYSBCWjJfYnpSZWFkKCku Ckl0IGlzIHdvcnRoIG1lbnRpb25pbmcgdGhhdCBCWjJfYnpSZWFkKCkgd2lsbCB0cnVuY2F0ZSBj dHJsWzBdIGZyb20KNjQtYml0IG9mZl90IHRvIDMyLWJpdCBpbnQuCgpJdCBpcyBleHBlY3RlZCB0 aGF0IGFuIGF0dGFja2VyIHRoYXQgaXMgYWJsZSB0byBkZWxpdmVyIGFuIHNwZWNpYWxseQpjcmFm dGVkIHBhdGNoIGZpbGUgY2FuIGdhaW4gcmVtb3RlIGNvZGUgZXhlY3V0aW9uIGNhcGFiaWxpdGll cyB3aGVuCmNlcnRhaW4gY29uZGl0aW9ucyBmb3IgZXhwbG9pdGF0aW9uIGFyZSBtZXQuCgpQcm9v ZiBvZiBDb25jZXB0Cj09PT09PT09PT09PT09PT0KQSBjcmFzaGluZyByZXByb2R1Y2VyIGNhbiBi ZSBkb3dubG9hZGVkIGZyb20KaHR0cHM6Ly9naXRodWIuY29tL3g0MXNlYy9hZHZpc29yaWVzL2Js b2IvbWFzdGVyL1g0MS0yMDIwLTAwNi94NDEtMjAyMC0wMDYtYnNwYXRjaC1wb2MucGF0Y2gKCkZp eAo9PT0KUGxlYXNlLCByZWZlciB0byB0aGUgRnJlZUJTRCBhZHZpc29yaWVzCmh0dHBzOi8vd3d3 LmZyZWVic2Qub3JnL3NlY3VyaXR5L2Fkdmlzb3JpZXMvRnJlZUJTRC1TQS0xNjoyNS5ic3BhdGNo LmFzYwphbmQKaHR0cHM6Ly93d3cuZnJlZWJzZC5vcmcvc2VjdXJpdHkvYWR2aXNvcmllcy9GcmVl QlNELVNBLTE2OjI5LmJzcGF0Y2guYXNjCmZvciBmaXhlcy4KCldvcmthcm91bmRzCj09PT09PT09 PT09CkFzIGEgd29ya2Fyb3VuZCwgb25seSBwYXRjaGVzIHBhc3NpbmcgaW50ZWdyaXR5IGFuZCBh dXRoZW50aWNpdHkKY2hlY2tzIHNob3VsZCBiZSBhcHBsaWVkLgoKVGltZWxpbmUKPT09PT09PT0K MjAxNi0wNy0yMSBDVkUtMjAxNC05ODYyIHB1Ymxpc2hlZAoyMDE2LTA3LTI1IFBhcnRpYWwgZml4 IGZvciBGcmVlQlNEIHB1Ymxpc2hlZCBhdCBGcmVlQlNELVNBLTE2OjI1LmJzcGF0Y2gKMjAxNi0x MC0xMCBDb21wbGV0ZSBmaXggZm9yIEZyZWVCU0QgcHVibGlzaGVkIGF0IEZyZWVCU0QtU0EtMTY6 MjkuYnNwYXRjaAoyMDIwLTA3LTAyIFg0MSBEaXNjb3ZlcnMgdGhlIHZ1bG5lcmFiaWxpdHkgd2Fz IG5vdCBvciBpbmNvcnJlY3RseQpmaXhlZCB1cHN0cmVhbSBhbmQgaW4gcHJvbWluZW50IGZvcmtz IG9mIHRoZSBjb2RlCjIwMjAtMDctMDYgQ29saW4gUGVyY2l2YWwgYW5kIGRpc3Ryb3NAIG5vdGlm aWVkCjIwMjAtMDctMDkgUHVibGljIGRpc2Nsb3N1cmUKCkFib3V0IFg0MSBELVNFQyBHbWJICj09 PT09PT09PT09PT09PT09PT09Clg0MSBpcyBhbiBleHBlcnQgcHJvdmlkZXIgZm9yIGFwcGxpY2F0 aW9uIHNlY3VyaXR5IHNlcnZpY2VzLgpIYXZpbmcgZXh0ZW5zaXZlIGluZHVzdHJ5IGV4cGVyaWVu Y2UgYW5kIGV4cGVydGlzZSBpbiB0aGUgYXJlYSBvZgppbmZvcm1hdGlvbiBzZWN1cml0eSwgYSBz dHJvbmcgY29yZSBzZWN1cml0eSB0ZWFtIG9mIHdvcmxkIGNsYXNzCnNlY3VyaXR5IGV4cGVydHMg ZW5hYmxlcyBYNDEgdG8gcGVyZm9ybSBwcmVtaXVtIHNlY3VyaXR5IHNlcnZpY2VzLgpGaWVsZHMg b2YgZXhwZXJ0aXNlIGluIHRoZSBhcmVhIG9mIGFwcGxpY2F0aW9uIHNlY3VyaXR5IGFyZSBzZWN1 cml0eQpjZW50ZXJlZCBjb2RlIHJldmlld3MsIGJpbmFyeSByZXZlcnNlIGVuZ2luZWVyaW5nIGFu ZCB2dWxuZXJhYmlsaXR5CmRpc2NvdmVyeS4KQ3VzdG9tIHJlc2VhcmNoIGFuZCBJVCBzZWN1cml0 eSBjb25zdWx0aW5nIGFuZCBzdXBwb3J0IHNlcnZpY2VzIGFyZSBjb3JlCmNvbXBldGVuY2llcyBv ZiBYNDEuCi0tLS0tQkVHSU4gUEdQIFNJR05BVFVSRS0tLS0tCgppUUl6QkFFQkNnQWRGaUVFcHd4 VlRneEFJY1V2VHVnSW81S2xwZzUwQ3hBRkFsOEhTUXdBQ2drUW81S2xwZzUwCkN4QU5xQkFBcGxI ekxRc2Y1R3BYcS9CeVBDTGhHamJCa1NhdjZvM2dPNDU1aTNMdElPUXhVYiszNlFXMHZqNG0KUTN2 aDZlVTZtQklpaVNmbzRLMEhXTERIRDdwL09zVGFGYis0OE1YM1J3UHFKbUM0ZUJuWHRtSFl1Q0Ri OGVMZwpHT005d3J0N01XMC80Q0M5eXp5dGJPd1lsU3ZhdzFNRzRMa3hIRjJEd1RMRm41L0lGOVFG aGtnQzhGQUxLY211CldhaXpGQ2FNZHVRV0dCZjdSNUNHbHp5Y1FLMVFMSHZ0QXJaWW1RNTI5TG0v VjB6d0xsbHFWZHZIak1rWGYrTjEKVkUyUldJazR5c1BMeFFBbFNCajl2cElxK1Z0bmRjYkJ4MUps M0R5ckFrWDl0YURGR204U014VnpMOGJCMlBkagplTlVxQmIrWGcrN2Z1by95TjRSSVd3L3JFOVZa amw5WkcyTVJ1OTRhazQxb2ROODRlbUxKWER4Mjk2Zk91K0RlCjhjellxN2NmaG42bVRlN2VkYVNP bFJ2aTZ2WEczQkN4RHYveHdJYVpqSTBMOU1JTFBGbFA2LzAwVks3YVRXbUgKYVJCeVQyUFZpV0pJ THBZSElER2pTUDVhelFCVkRLZlhJc1B6VkRCNHhidWhLcGd2akxRbzhjU3FmSzBnRXB5VQplQ1JM cW5PTDNDeC9MSm1PM3pxZCs5VHNQTGZ4UGdvOFBuQy9pSGpUVVhwK0RpLzlmWGpMKzdXVlYxa2Mx S3k2ClRXNmhzV0hFRUwxRlNiY2NPSnFhUElBd0VIMVZFYm8wZ3pibEIxSjcwY2ZiclE1Uk04eUkx K0x2VkJpdXgwcnIKTlNQR0l4NHhKVjNwcDZHVFZkSnFtNEJKOGFaZmsyU0hlT1ZSTDRPWTBTTlFx eEFZQldrPQo9UG5uQgotLS0tLUVORCBQR1AgU0lHTkFUVVJFLS0tLS0KCl9fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fClNlbnQgdGhyb3VnaCB0aGUgRnVsbCBE aXNjbG9zdXJlIG1haWxpbmcgbGlzdApodHRwczovL25tYXAub3JnL21haWxtYW4vbGlzdGluZm8v ZnVsbGRpc2Nsb3N1cmUKV2ViIEFyY2hpdmVzICYgUlNTOiBodHRwOi8vc2VjbGlzdHMub3JnL2Z1 bGxkaXNjbG9zdXJlLw==