CVE-2016-0856
published 2016-01-15CVE-2016-0856: Multiple stack-based buffer overflows in Advantech WebAccess before 8.1 allow remote attackers to execute arbitrary code via unspecified vectors.
PriorityP265critical9.8CVSS 3.0
AVNACLPRNUINSUCHIHAH
EPSS
16.66%
96.6th percentile
Multiple stack-based buffer overflows in Advantech WebAccess before 8.1 allow remote attackers to execute arbitrary code via unspecified vectors.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| advantech | webaccess | <= 8.0 | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Monitor TCP traffic on ports 4592 and 14592 for unauthenticated RPC calls to webvrpcs.exe and datacore.exe; both interfaces accept connections from remote unauthenticated clients. ↗
- →Detect RPC attack packets targeting CVE-2016-0856 by looking for the IOCTL value 0x01388b in the payload on TCP port 4592, combined with an oversized input string (length field 0x8c / 140 bytes) exceeding the 0x80-byte stack buffer in BwOpcSvc.dll. ↗
- →Alert on unexpected crashes or restarts of webvrpcs.exe; the watchdog process webvkeep will automatically restart it after a crash, which may indicate repeated exploitation attempts. ↗
- ·The vulnerability exists in Advantech WebAccess version 8.0 and was fixed in version 8.2; version 8.1 is also listed as vulnerable per the NVD advisory. ↗
- ·The RPC service webvrpcs.exe runs as local administrator, meaning successful exploitation grants SYSTEM-level equivalent privileges on the target. ↗
CVSS provenance
nvdv3.09.8CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C
ghsa7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-77fq-72hq-rrj5: Multiple stack-based buffer overflows in Advantech WebAccess before 8
ghsa_unreviewed·2022-05-17
CVE-2016-0856 [CRITICAL] CWE-119 GHSA-77fq-72hq-rrj5: Multiple stack-based buffer overflows in Advantech WebAccess before 8
Multiple stack-based buffer overflows in Advantech WebAccess before 8.1 allow remote attackers to execute arbitrary code via unspecified vectors.
GHSA
ChakraCore RCE Vulnerability
ghsa·2022-05-13·CVSS 7.5
CVE-2018-0835 [HIGH] CWE-787 ChakraCore RCE Vulnerability
ChakraCore RCE Vulnerability
Microsoft Edge and ChakraCore in Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, due to how the scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2018-0834, CVE-2018-0836, CVE-2018-0837, CVE-2018-0838, CVE-2018-0840, CVE-2018-0856, CVE-2018-0857, CVE-2018-0858, CVE-2018-0859, CVE-2018-0860, CVE-2018-0861, and CVE-2018-0866.
GHSA
ChakraCore RCE Vulnerability
ghsa·2022-05-13·CVSS 7.5
CVE-2018-0857 [HIGH] CWE-787 ChakraCore RCE Vulnerability
ChakraCore RCE Vulnerability
Microsoft Edge and ChakraCore in Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, due to how the scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2018-0834, CVE-2018-0835, CVE-2018-0836, CVE-2018-0837, CVE-2018-0838, CVE-2018-0840, CVE-2018-0856, CVE-2018-0858, CVE-2018-0859, CVE-2018-0860, CVE-2018-0861, and CVE-2018-0866.
GHSA
ChakraCore RCE Vulnerability
ghsa·2022-05-13·CVSS 7.5
CVE-2018-0859 [HIGH] CWE-787 ChakraCore RCE Vulnerability
ChakraCore RCE Vulnerability
Microsoft Edge and ChakraCore in Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, due to how the scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2018-0834, CVE-2018-0835, CVE-2018-0836, CVE-2018-0837, CVE-2018-0838, CVE-2018-0840, CVE-2018-0856, CVE-2018-0857, CVE-2018-0858, CVE-2018-0860, CVE-2018-0861, and CVE-2018-0866.
GHSA
ChakraCore RCE Vulnerability
ghsa·2022-05-13·CVSS 7.5
CVE-2018-0860 [HIGH] CWE-787 ChakraCore RCE Vulnerability
ChakraCore RCE Vulnerability
Microsoft Edge and ChakraCore in Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, due to how the scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2018-0834, CVE-2018-0835, CVE-2018-0836, CVE-2018-0837, CVE-2018-0838, CVE-2018-0840, CVE-2018-0856, CVE-2018-0857, CVE-2018-0858, CVE-2018-0859, CVE-2018-0861, and CVE-2018-0866.
GHSA
ChakraCore RCE Vulnerability
ghsa·2022-05-13·CVSS 7.5
CVE-2018-0834 [HIGH] CWE-787 ChakraCore RCE Vulnerability
ChakraCore RCE Vulnerability
Microsoft Edge and ChakraCore in Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, due to how the scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2018-0835, CVE-2018-0836, CVE-2018-0837, CVE-2018-0838, CVE-2018-0840, CVE-2018-0856, CVE-2018-0857, CVE-2018-0858, CVE-2018-0859, CVE-2018-0860, CVE-2018-0861, and CVE-2018-0866.
GHSA
ChakraCore RCE Vulnerability
ghsa·2022-05-13·CVSS 7.5
CVE-2018-0837 [HIGH] CWE-787 ChakraCore RCE Vulnerability
ChakraCore RCE Vulnerability
Microsoft Edge and ChakraCore in Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, due to how the scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2018-0834, CVE-2018-0835, CVE-2018-0836, CVE-2018-0838, CVE-2018-0840, CVE-2018-0856, CVE-2018-0857, CVE-2018-0858, CVE-2018-0859, CVE-2018-0860, CVE-2018-0861, and CVE-2018-0866.
GHSA
ChakraCore RCE Vulnerability
ghsa·2022-05-13·CVSS 7.5
CVE-2018-0838 [HIGH] CWE-787 ChakraCore RCE Vulnerability
ChakraCore RCE Vulnerability
Microsoft Edge and ChakraCore in Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, due to how the scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2018-0834, CVE-2018-0835, CVE-2018-0836, CVE-2018-0837, CVE-2018-0840, CVE-2018-0856, CVE-2018-0857, CVE-2018-0858, CVE-2018-0859, CVE-2018-0860, CVE-2018-0861, and CVE-2018-0866.
CISA ICS
Advantech WebAccess Vulnerabilities
cisa_ics·2018-08-23
Advantech WebAccess Vulnerabilities
## Archived Content In an effort to keep CISA.gov current, the archive contains outdated information that may not reflect current policy or programs.
ICS Advisory
##
Advantech WebAccess Vulnerabilities
Last RevisedAugust 23, 2018
Alert CodeICSA-16-014-01
## OVERVIEW
Ilya Karpov of Positive Technologies, Ivan Sanchez, Andrea Micalizzi, Ariele Caltabiano, Fritz Sands, Steven Seeley, and an anonymous researcher have identified multiple vulnerabilities in Advantech WebAccess application. Many of these vulnerabilities were reported through the Zero Day Initiative (ZDI) and iDefense. Advantech has produced a new version to mitigate these vulnerabilities. Ivan Sanchez has tested the new version to validate that it resolves the vulnerabilities which
No detection rules found.
No public exploits indexed.
Trendmicro
Deep Dive into an attack on an RPC interface
blogs_trendmicro·2018-06-07
Deep Dive into an attack on an RPC interface
## Down the Rabbit Hole - A Deep Dive into an attack on an RPC interface
Take a Deep Dive into an attack on an RPC interface
By: Zero Day Initiative Jun 07, 2018 Read time: ( words)
Save to Folio
Recently, the ZDI received and purchased a trove of vulnerability reports from an anonymous researcher who targeted the Advantech WebAccess product. The vulnerabilities were all in C string handling functions (strcpy and sprintf, for the most part) and were reached through two RPC interfaces. The proofs of concept for the vulnerability submissions were very detailed and show how to write a custom RPC client to set up attacks. This blog post walks through one of the attacks, showing all of the details. Additionally, we are releasing the source code for this attack in parallel with this post. Yo
Trendmicro
Deep Dive into an attack on an RPC interface
blogs_trendmicro·2018-06-07
Deep Dive into an attack on an RPC interface
## Down the Rabbit Hole - A Deep Dive into an attack on an RPC interface
Take a Deep Dive into an attack on an RPC interface
By: Zero Day Initiative Jun 07, 2018 Read time: ( words)
Save to Folio
Recently, the ZDI received and purchased a trove of vulnerability reports from an anonymous researcher who targeted the Advantech WebAccess product. The vulnerabilities were all in C string handling functions (strcpy and sprintf, for the most part) and were reached through two RPC interfaces. The proofs of concept for the vulnerability submissions were very detailed and show how to write a custom RPC client to set up attacks. This blog post walks through one of the attacks, showing all of the details. Additionally, we are releasing the source code for this attack in parallel with this post. Yo
Trendmicro
Deep Dive into an attack on an RPC interface
blogs_trendmicro·2018-06-07
Deep Dive into an attack on an RPC interface
## Down the Rabbit Hole - A Deep Dive into an attack on an RPC interface
Take a Deep Dive into an attack on an RPC interface
By: Zero Day Initiative 2018/06/07 Read time: ( words)
Save to Folio
Recently, the ZDI received and purchased a trove of vulnerability reports from an anonymous researcher who targeted the Advantech WebAccess product. The vulnerabilities were all in C string handling functions (strcpy and sprintf, for the most part) and were reached through two RPC interfaces. The proofs of concept for the vulnerability submissions were very detailed and show how to write a custom RPC client to set up attacks. This blog post walks through one of the attacks, showing all of the details. Additionally, we are releasing the source code for this attack in parallel with this post. You
Trendmicro
Deep Dive into an attack on an RPC interface
blogs_trendmicro·2018-06-07
Deep Dive into an attack on an RPC interface
# Down the Rabbit Hole - A Deep Dive into an attack on an RPC interface
Take a Deep Dive into an attack on an RPC interface
By: Zero Day Initiative
2018/06/07
Read time: ( words)
Save to Folio
Recently, the ZDI received and purchased a trove of vulnerability reports from an anonymous researcher who targeted the Advantech WebAccess product. The vulnerabilities were all in C string handling functions (strcpy and sprintf, for the most part) and were reached through two RPC interfaces. The proofs of concept for the vulnerability submissions were very detailed and show how to write a custom RPC client to set up attacks. This blog post walks through one of the attacks, showing all of the details. Additionally, we are releasing the source code for this attack in parallel with this post. You
http://www.zerodayinitiative.com/advisories/ZDI-16-100http://www.zerodayinitiative.com/advisories/ZDI-16-101http://www.zerodayinitiative.com/advisories/ZDI-16-102http://www.zerodayinitiative.com/advisories/ZDI-16-103http://www.zerodayinitiative.com/advisories/ZDI-16-106http://www.zerodayinitiative.com/advisories/ZDI-16-108http://www.zerodayinitiative.com/advisories/ZDI-16-109http://www.zerodayinitiative.com/advisories/ZDI-16-110http://www.zerodayinitiative.com/advisories/ZDI-16-111http://www.zerodayinitiative.com/advisories/ZDI-16-112http://www.zerodayinitiative.com/advisories/ZDI-16-113http://www.zerodayinitiative.com/advisories/ZDI-16-114http://www.zerodayinitiative.com/advisories/ZDI-16-115http://www.zerodayinitiative.com/advisories/ZDI-16-116http://www.zerodayinitiative.com/advisories/ZDI-16-117http://www.zerodayinitiative.com/advisories/ZDI-16-118http://www.zerodayinitiative.com/advisories/ZDI-16-120https://ics-cert.us-cert.gov/advisories/ICSA-16-014-01http://www.zerodayinitiative.com/advisories/ZDI-16-100http://www.zerodayinitiative.com/advisories/ZDI-16-101http://www.zerodayinitiative.com/advisories/ZDI-16-102http://www.zerodayinitiative.com/advisories/ZDI-16-103http://www.zerodayinitiative.com/advisories/ZDI-16-106http://www.zerodayinitiative.com/advisories/ZDI-16-108http://www.zerodayinitiative.com/advisories/ZDI-16-109http://www.zerodayinitiative.com/advisories/ZDI-16-110http://www.zerodayinitiative.com/advisories/ZDI-16-111http://www.zerodayinitiative.com/advisories/ZDI-16-112http://www.zerodayinitiative.com/advisories/ZDI-16-113http://www.zerodayinitiative.com/advisories/ZDI-16-114http://www.zerodayinitiative.com/advisories/ZDI-16-115http://www.zerodayinitiative.com/advisories/ZDI-16-116http://www.zerodayinitiative.com/advisories/ZDI-16-117http://www.zerodayinitiative.com/advisories/ZDI-16-118http://www.zerodayinitiative.com/advisories/ZDI-16-120https://ics-cert.us-cert.gov/advisories/ICSA-16-014-01
2016-01-15
Published