CVE-2019-9017
📋 TL;DR
This vulnerability in SolarWinds DameWare Mini Remote Control allows attackers to cause a buffer overflow by manipulating the machine name size field. This can lead to denial of service or potentially arbitrary code execution. Organizations using the affected version of this remote administration tool are at risk.
💻 Affected Systems
- SolarWinds DameWare Mini Remote Control
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise and lateral movement within the network
Likely Case
Denial of service causing the DameWare service to crash, disrupting remote administration capabilities
If Mitigated
Service disruption only, with no privilege escalation or lateral movement
🎯 Exploit Status
Public exploit code exists and demonstrates denial of service. Code execution may require additional development.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Later versions (check SolarWinds for specific fixed version)
Vendor Advisory: https://www.solarwinds.com/securityadvisory
Restart Required: Yes
Instructions:
1. Check current DameWare version
2. Download latest version from SolarWinds portal
3. Install update following vendor instructions
4. Restart affected systems
🔧 Temporary Workarounds
Network Segmentation
allRestrict access to DameWare services to trusted networks only
Use firewall rules to block external access to DameWare ports (typically 6129)
Service Disablement
windowsTemporarily disable DameWare services if not critically needed
sc stop "DameWare Mini Remote Control"
sc config "DameWare Mini Remote Control" start= disabled
🧯 If You Can't Patch
- Implement strict network access controls to limit exposure
- Monitor for crash events in DameWare service logs
🔍 How to Verify
Check if Vulnerable:
Check installed version of DameWare Mini Remote Control. Version 10.0 x64 is vulnerable.Check Version:
Check program version in Control Panel > Programs and Features or run: wmic product where "name like '%DameWare%'" get versionVerify Fix Applied:
Verify installed version is newer than 10.0 x64 and test service functionality📡 Detection & Monitoring
Log Indicators:
- DameWare service crashes
- Unexpected termination of dwrcs.exe or dwmrcs.exe processes
Network Indicators:
- Unusual traffic to DameWare ports (typically 6129)
- Malformed packets targeting the service
SIEM Query:
EventID: 1000 OR 1001 with Source: dwrcs.exe OR dwmrcs.exe🔗 References
- http://packetstormsecurity.com/files/152721/SolarWinds-DameWare-Mini-Remote-Control-10.0-Denial-Of-Service.html
- http://www.binaryworld.it/guidepoc.asp
- https://www.exploit-db.com/exploits/46793/
- http://packetstormsecurity.com/files/152721/SolarWinds-DameWare-Mini-Remote-Control-10.0-Denial-Of-Service.html
- http://www.binaryworld.it/guidepoc.asp
- https://www.exploit-db.com/exploits/46793/
