CVE-2019-7228

The ABB IDAL HTTP server mishandles format strings in a username or cookie during the authentication process. Attempting to authenticate with the username %25s%25p%25x%25n will crash the server. Sending %08x.AAAA.%08x.%08x will log memory content from the stack.

The ABB IDAL HTTP server mishandles format strings in a username or cookie during the authentication process. Attempting to authenticate with the username %25s%25p%25x%25n will crash the server. Sending %08x.AAAA.%08x.%08x will log memory content from the stack.

El servidor HTTP ABB IDAL maneja las cadenas de formato en un nombre de usuario o cookie durante el proceso de identificación . Si se intenta autenticar con el nombre de usuario% 25s% 25p% 25x% 25n se bloqueará el servidor. Al enviar% 08x.AAAA.% 08x.% 08x se registrará el contenido de la memoria de la pila.