Vulnerability Spotlight: Multiple vulnerabilities in AT&T Labs’ Xmill utility
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2021-21810 | A memory corruption vulnerability exists in the XML-parsing ParseAttribs functionality of AT&T Labs’ Xmill 0.7. A memory corruption vulnerability exists in the XML-parsing ParseAttribs functionality of AT&T Labs’ Xmill 0.7. A specially crafted XML file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability. NVD description · AI analysis pending | 9.8 | 1% | PoC |
| — | |
| CVE-2021-21811 | A memory corruption vulnerability exists in the XML-parsing CreateLabelOrAttrib functionality of AT&T Labs’ Xmill 0.7. A memory corruption vulnerability exists in the XML-parsing CreateLabelOrAttrib functionality of AT&T Labs’ Xmill 0.7. A specially crafted XML file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability. NVD description · AI analysis pending | 9.8 | 1% | PoC |
| — | |
| CVE-2021-21829 | A heap-based buffer overflow vulnerability exists in the XML Decompression EnumerationUncompressor::UncompressItem functionality of AT&T Labs’ Xmill 0.7. A heap-based buffer overflow vulnerability exists in the XML Decompression EnumerationUncompressor::UncompressItem functionality of AT&T Labs’ Xmill 0.7. A specially crafted XMI file can lead to remote code execution. An attacker can provide a malicious file to trigger this vulnerability. NVD description · AI analysis pending | 9.8 group max | 3% | PoC |
| — | |
| CVE-2021-21825 | A heap-based buffer overflow vulnerability exists in the XML Decompression PlainTextUncompressor::UncompressItem functionality of AT&T Labs’ Xmill 0.7. A heap-based buffer overflow vulnerability exists in the XML Decompression PlainTextUncompressor::UncompressItem functionality of AT&T Labs’ Xmill 0.7. A specially crafted XMI file can lead to remote code execution. An attacker can provide a malicious file to trigger this vulnerability. NVD description · AI analysis pending | 9.8 | 2% | PoC |
| — | |
| CVE-2021-21826 +1 in the same advisory: …21828 | A heap-based buffer overflow vulnerability exists in the XML Decompression DecodeTreeBlock functionality of AT&T Labs Xmill 0.7. A heap-based buffer overflow vulnerability exists in the XML Decompression DecodeTreeBlock functionality of AT&T Labs Xmill 0.7. Within `DecodeTreeBlock` which is called during the decompression of an XMI file, a UINT32 is loaded from the file and used as trusted input as the length of a buffer. An attacker can provide a malicious file to trigger this vulnerability. NVD description · AI analysis pending | 9.8 | 1% | PoC |
| — |
Full article368 words · extracted from blog.talosintelligence.com · click to collapse
Tuesday, August 10, 2021 13:22
Carl Hurd of Cisco Talos discovered these vulnerabilities.
Cisco Talos recently discovered multiple vulnerabilities in AT&T Labs’ Xmill utility. An attacker could take advantage of these issues to carry out a variety of malicious actions, including corrupting the application’s memory and gaining the ability to execute remote code.
Xmill and Xdemill are utilities that are purpose-built for XML compression and decompression, respectively. These utilities claim to be roughly two times more efficient at compressing XML than other compression methods. As of publishing, AT&T Labs is no longer supporting this software and, therefore, will not be issuing any patches. The software, released in 1999, can still be found in modern software suites, such as Schneider Electric's EcoStruxure Control Expert. Schneider is working to fix issues directly impacting Schneider Electric’s EcoStruxure Control Expert.
TALOS-2021-1278 (CVE-2021-21810) and TALOS-2021-1279 (CVE-2021-21811) are memory corruption vulnerabilities in the utility. An adversary could exploit these vulnerabilities by tricking the user into opening a specially crafted XML file.
Xmill also contains four heap-based buffer overflow vulnerabilities: TALOS-2021-1290 (CVE-2021-21825), TALOS-2021-1291 (CVE-2021-21826 - CVE-2021-21828), TALOS-2021-1292 (CVE-2021-21829) and TALOS-2021-1293 (CVE-2021-21830). These could all be exploited by an adversary to gain the ability to execute code on the victim machine.
Another vulnerability, TALOS-2021-1280 (CVE-2021-21812 - CVE-2021-21815), could also lead to remote code execution. However, in this case, an attacker could only exploit this vulnerability by first executing a specially crafted command-line argument on the victim machine.
Only a subset of these Xmill vulnerabilities directly affects Schenider’s Control Expert software: TALOS-2021-1290, TALOS-2021-1291, TALOS-2021-1292 and TALOS-2021-1293, which all directly affect Control Expert and are based around XML decompression within the software.
Cisco Talos worked with AT&T and Schneider to disclose these vulnerabilities in adherence to Cisco’s vulnerability disclosure policy.
Talos tested and confirmed these vulnerabilities affect AT&T Labs Xmill, version 0.7. However, there is no update available, as AT&T is no longer supporting this product.
The following SNORTⓇ rules will detect exploitation attempts against this vulnerability: 57503 - 57508. Additional rules may be released in the future and current rules are subject to change, pending additional vulnerability information. For the most current rule information, please refer to your Firepower Management Center or Snort.org.
Text extracted automatically; images, tables and formatting may be missing. Original: https://blog.talosintelligence.com/vuln-spotlight-att/