ASUS BMC's firmware: buffer overflow - Active Directory configuration function

Vulnerability

A buffer overflow vulnerability exists in the Active Directory configuration function of ASUS BMC firmware's web management page. The function fails to verify the length of user-supplied strings, allowing a buffer overflow when processing crafted input. Affected firmware versions include Z10PR-D16 1.14.51, ASMB8-iKVM 1.14.51, and Z10PE-D16 WS 1.14.2 [1].

Exploitation

An attacker must first obtain privileged administrative access to the BMC web interface. With that access, the attacker can send a specially crafted request to the Active Directory configuration endpoint, triggering the buffer overflow. No additional user interaction is required [1].

Impact

Successful exploitation causes the web service to terminate abnormally, resulting in a denial of service (availability impact). No confidentiality or integrity impact is described [1].

Mitigation

ASUS has released updated firmware versions that fix the vulnerability: Z10PR-D16 1.16.1, ASMB8-iKVM 1.16.1, and Z10PE-D16 WS 1.16.1. Users should update to these versions. No workarounds are documented, and the vulnerability is not listed on CISA's Known Exploited Vulnerabilities catalog [1].