module

Rocket Software Unidata udadmin_server Stack Buffer Overflow in Password

Try Surface Command
Back to search
Disclosed
2023-03-30
Created
2023-04-12

Description

This modlue exploits an authentication bypass vulnerability in the
Linux version of udadmin_server, which is an RPC service that comes
with the Rocket Software UniData server, which runs as root.

This vulnerability affects UniData versions 8.2.4 build 3003 and
earlier (for Linux), but this module specifically targets UniData
version 8.2.4 build 3001. Other versions will crash the forked
process, but will not otherwise affect the RPC server.

The username and password fields are copied to a stack-based buffer
using a function that's equivalent to strcpy() (ie, has no bounds
checking). Additionally, the password field is encoded in such a way
that we can include NUL bytes.

Author

Ron Bowes

Platform

Linux,Unix

Architectures

x86, x64, cmd

References

Module Options

To display the available options, load the module within the Metasploit console and run the commands ‘show options’ or ‘show advanced’:


    msf > use exploit/linux/misc/unidata_udadmin_password_stack_overflow
    msf exploit(unidata_udadmin_password_stack_overflow) > show targets
        ...targets...
    msf exploit(unidata_udadmin_password_stack_overflow) > set TARGET < target-id >
    msf exploit(unidata_udadmin_password_stack_overflow) > show options
        ...show and set options...
    msf exploit(unidata_udadmin_password_stack_overflow) > exploit
Title
NEW

Explore Exposure Command

Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.

Try it today