CVE-2017-17968
published 2017-12-29CVE-2017-17968: A buffer overflow vulnerability in NetTransport.exe in NetTransport Download Manager 2.96L and earlier could allow remote HTTP servers to execute arbitrary…
PriorityP269critical9.8CVSS 3.0
AVNACLPRNUINSUCHIHAH
EXPLOIT
EPSS
39.37%
98.4th percentile
A buffer overflow vulnerability in NetTransport.exe in NetTransport Download Manager 2.96L and earlier could allow remote HTTP servers to execute arbitrary code on NAS devices via a long HTTP response.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| xi-soft | nettransport_download_manager | <= 2.96l | — |
Detection & IOCsextracted from sources · hover to see the quote
bytes↗
\xd9\xcb\xbe\xb9\x23\x67\x31\xd9\x74\x24\xf4\x5a\x29\xc9\xb1\x13\x31\x72\x19\x83\xc2\x04\x03\x72\x15\x5b\xd6\x56\xe3\xc9\x71\xfa\x62\x81\xe2\x75\x82\x0b\xb3\xe1\xc0\xd9\x0b\x61\xa0\x11\xe7\x03\x41\x84\x7c\xdb\xd2\xa8\x9a\x97\xba\x68\x10\xfb\x5b\xe8\xad\x70\x7b\x28\xb3\x86\x08\x64\xac\x52\x0e\x8d\xdd\x2d\x3c\x3c\xa0\xfc\xbc\x82\x23\xa8\xd7\x94\x6e\x23\xd9\xe3\x05\xd4\x05\xf2\x1b\xe9\x09\x5a\x1c\x39\xbd
- →The exploit works by binding a rogue HTTP server on port 80 and sending an oversized HTTP 200 response (~60,000 bytes) to the victim NetTransport client. Detect outbound connections from NetTransport.exe to untrusted servers followed by an abnormally large HTTP response header. ↗
- →The malicious HTTP response begins with 'HTTP/1.1 200 ' followed by 16,739 bytes of 'A' padding before the ROP chain. A Snort/Suricata rule matching HTTP responses with status line content exceeding several thousand bytes from the status line itself is a strong indicator. ↗
- →The exploit uses VirtualProtect() ROP chain to bypass DEP. Monitor for NetTransport.exe calling VirtualProtect with PAGE_EXECUTE_READWRITE (0x40) on stack-region memory addresses. ↗
- →The overflow is triggered at an offset of 16,739 bytes ('A'*16739). Network signatures should alert on HTTP response bodies where the status-line value field alone exceeds ~16,000 bytes. ↗
- ·The exploit was tested specifically against version 2.90.510 in the Metasploit module, while the CVE covers 2.96L and earlier. ROP gadget offsets (hardcoded addresses in NetTransport.exe and libssl.dll) are version-specific and will differ across builds. ↗
- ·No vendor patch was available at the time of disclosure. Mitigation relies on network-level controls blocking rogue HTTP servers from responding to NetTransport client requests. ↗
CVSS provenance
nvdv3.09.8CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
NetTransport 2.96L - Remote Buffer Overflow (DEP Bypass)
exploitdb·2017-12-29·CVSS 9.8
CVE-2017-17968 [CRITICAL] NetTransport 2.96L - Remote Buffer Overflow (DEP Bypass)
NetTransport 2.96L - Remote Buffer Overflow (DEP Bypass)
---
#!/usr/bin/python
# Exploit Title: Buffer overflow in NetTransport Download Manager - Version 2.96L (DEP Bypass)
# CVE: CVE-2017-17968
# Date: 28-12-2017
# Software Link: http://xi-soft.com/downloads/NXSetup_x86.zip
# Exploit Author: Author: Aloyce J. Makalanga
# Contact: https://twitter.com/aloycemjr
# Vendor Homepage: http://xi-soft.com/default.htm
# Category: webapps
# Impact: Code execution
#1. Description
#
#A buffer overflow vulnerability in NetTransport.exe in NetTransport Download Manager 2.96L and earlier could allow remote HTTP servers to execute arbitrary code on NAS devices via a long HTTP response. To exploit this vulnerability, an attacker needs to issue a malicious-crafted payload in the HTTP Response Header. A
Metasploit
NetTransport Download Manager 2.90.510 Buffer Overflow
metasploit
NetTransport Download Manager 2.90.510 Buffer Overflow
NetTransport Download Manager 2.90.510 Buffer Overflow
This exploits a stack buffer overflow in NetTransport Download Manager, part of the NetXfer suite. This module was tested successfully against version 2.90.510.
No writeups or analysis indexed.
2017-12-29
Published