#######################################################################

                             Luigi Auriemma

Application:  DATAC RealWin
              http://www.dataconline.com/software/realwin.php
              http://www.realflex.com
Versions:     <= 2.0 (Build 6.1.8.10)
Platforms:    Windows
Bugs:         A] stack overflow in SCPC_INITIALIZE and SCPC_INITIALIZE_RF
              B] stack overflow in SCPC_TXTEVENT
Exploitation: remote, versus server
Date:         15 Oct 2010
Author:       Luigi Auriemma
              e-mail: aluigi@autistici.org
              web:    aluigi.org


#######################################################################


1) Introduction
2) Bugs
3) The Code
4) Fix


#######################################################################

===============
1) Introduction
===============


"RealWin is a SCADA server package for medium / small applications."


#######################################################################

=======
2) Bugs
=======


-----------------------------------------------------------
A] stack overflow in SCPC_INITIALIZE and SCPC_INITIALIZE_RF
-----------------------------------------------------------

The service of the server running on port 912 is vulnerable to a
stack based buffer-overflow caused by the usage of sprintf() for
building a particular string with the data supplied by the attacker:

  sprintf(
    stack_buffer,
    "C:\\Program Files\\...path_of_RealWin...\\data\\crt\\fwd\\tel\\%s.%d",
    attacker_string,
    attacker_16bit_number);


----------------------------------
B] stack overflow in SCPC_TXTEVENT
----------------------------------

The same server is vulnerable also to another stack based overflow
caused by the usage of strcpy() with the data supplied by the attacker.


#######################################################################

===========
3) The Code
===========


http://aluigi.org/poc/realwin_1.zip

  nc SERVER 912 < realwin_1a.dat
  nc SERVER 912 < realwin_1b.dat
  nc SERVER 912 < realwin_1c.dat


#######################################################################

======
4) Fix
======


No fix.


#######################################################################