Rapid7 Vulnerability & Exploit Database

Rocket Software Unidata udadmin_server Stack Buffer Overflow in Password

Back to Search

Rocket Software Unidata udadmin_server Stack Buffer Overflow in Password

Disclosed
03/30/2023
Created
04/12/2023

Description

This modlue exploits an authentication bypass vulnerability in the Linux version of udadmin_server, which is an RPC service that comes with the Rocket Software UniData server, which runs as root. This vulnerability affects UniData versions 8.2.4 build 3003 and earlier (for Linux), but this module specifically targets UniData version 8.2.4 build 3001. Other versions will crash the forked process, but will not otherwise affect the RPC server. The username and password fields are copied to a stack-based buffer using a function that's equivalent to strcpy() (ie, has no bounds checking). Additionally, the password field is encoded in such a way that we can include NUL bytes.

Author(s)

  • Ron Bowes

Platform

Linux,Unix

Architectures

x86, x64, cmd

Development

Module Options

To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':

msf > use exploit/linux/misc/unidata_udadmin_password_stack_overflow
msf exploit(unidata_udadmin_password_stack_overflow) > show targets
    ...targets...
msf exploit(unidata_udadmin_password_stack_overflow) > set TARGET < target-id >
msf exploit(unidata_udadmin_password_stack_overflow) > show options
    ...show and set options...
msf exploit(unidata_udadmin_password_stack_overflow) > exploit

Metasploit

Penetration testing software for offensive security teams.
Key Features
Free Metasploit Pro Trial View All Features

Time is precious, so I don’t want to do something manually that I can automate. Leveraging the Metasploit Framework when automating any task keeps us from having to re-create the wheel as we can use the existing libraries and focus our efforts where it matters.

– Jim O’Gorman | President, Offensive Security

;