CVE-2021-20093

Vulnerability

The vulnerability is a buffer over-read in the CodeMeter CmLAN server (CodeMeter Runtime Server) in versions prior to 7.21a. The server accepts unencrypted messages starting with \xA2\x05 [1]. When generating a response, the server copies data from a fixed-size heap buffer of 0x100 bytes to an output buffer, using a copy size controlled by the client. This allows reading beyond the buffer bounds [1].

Exploitation

An unauthenticated remote attacker sends a specially crafted packet to the CodeMeter CmLAN server (default port) with a message body starting with \xA2\x05 and a crafted length field. The server then copies more data than available, resulting in a heap buffer over-read. A proof-of-concept using Python and netcat demonstrates heap memory disclosure [1]. No special privileges or user interaction are required.

Impact

Successful exploitation leads to information disclosure of heap memory contents or denial of service via crash of the CodeMeter Runtime Server (CodeMeter.exe) [1][2]. The CVSS v3 score is 9.1 (Critical) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H [2].

Mitigation

Wibu-Systems released version 7.21a which fixes the vulnerability [1][2]. If unable to update, administrators can configure CodeMeter to run as client only and bind to localhost, or use a firewall to restrict access to the CmLAN server port [2].