Advantech WebAccess Stack Buffer Overflow (CVE-2018-18999)

### Synopsis While developing a Nessus plugin to detect [CVE-2017-16720](https://www.tenable.com/cve/CVE-2017-16720), Tenable found an unauthenticated remote stack buffer overflow in **BwPAlarm.dll** shipped with Advantech WebAccess version 8.3.2. The flaw is due to improper validation of user-supplied input. The overflow can be triggered by sending a specially crafted DCERPC message with opcode 70022 to **webvrpcs.exe**. The following disassembly shows the vulnerable code copies a user-supplied string to a fixed-size stack buffer: ``` .text:0700391E lea edx, [ebp+var_59C] ; stack buffer of fixed size .text:07003924 repne scasb ; edi = user-supplied string .text:07003926 not ecx ; length of the string including the NUL char .text:07003928 sub edi, ecx .text:0700392A push 3Ah .text:0700392C mov eax, ecx .text:0700392E mov esi, edi .text:07003930 mov edi, edx .text:07003932 shr ecx, 2 .text:07003935 rep movsd ; strcpy(stack_buf, long_str) = stack overflow!!! .text:07003937 mov ecx, eax .text:07003939 and ecx, 3 .text:0700393C rep movsb ```