CVE-2018-7507 – Delta Industrial Automation WPLSoft dvp File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

https://notcve.org/view.php?id=CVE-2018-7507

WPLSoft in Delta Electronics versions 2.45.0 and prior utilizes a fixed length heap buffer where a value larger than the buffer can be read from a file into the buffer, causing the buffer to be overwritten, which may allow remote code execution or cause the application to crash. WPLSoft en Delta Electronics en versiones 2.45.0 y anteriores emplea un búfer de memoria dinámica (heap) con un tamaño fijo en el que un valor más grande que el búfer puede ser leído en en el búfer desde un archivo. Esto provoca que el búfer se sobrescriba, lo que podría permitir la ejecución remota de código o que la aplicación se cierre inesperadamente. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Delta Industrial Automation WPLSoft. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of dvp files. • http://www.securityfocus.com/bid/103179 https://ics-cert.us-cert.gov/advisories/ICSA-18-058-02 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-122: Heap-based Buffer Overflow •