bugtraq - Akamai Technologies Security Advisory 2007-0001

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-ID: <4623D7AA.1050909@akamai.com>
Date: Mon, 16 Apr 2007 16:08:10 -0400
From: Akamai Security Team <security@...mai.com>
To: bugtraq@...urityfocus.com, full-disclosure@...ts.grok.org.uk
Subject: Akamai Technologies Security Advisory 2007-0001

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- ----------------------------------------------------
Akamai Technologies Security Advisory 2007-0001


* Akamai ID:         2007-0001
* Date:              2007/04/16
* Product Name:      Download Manager
* Affected Versions: < 2.2.1.0
* Fixed Version:     2.2.1.0
* CVE IDs:           CVE-2007-1891 CVE-2007-1892
* CVSS Base Score:   (AV:R/AC:H/Au:NR/C:C/I:C/A:C/B:N) 8.0

* Product Description:

Akamai Download Manager is a client software application that helps
users download content easily, quickly, and reliably.  It is available
as an ActiveX component or Java applet and provides users the ability
to pause, resume downloading at a later time, and automatically
recover from dropped connections or system crashes.


* Vulnerability Description:

Two security vulnerabilities have been discovered in the ActiveX
version of Akamai Download Manager.  For successful exploitation, both
vulnerabilities require the user to visit a malicious URL, triggering
a stack-based buffer overflow that allows the attacker to execute
arbitrary code within the context of the victim.

Vulnerability CVE-2007-1891 affects versions newer than 2.0.4.4 and
older than 2.2.1.0.  Vulnerability CVE-2007-1892 affects all versions
prior to 2.2.1.0.  Both are remediated by installing version 2.2.1.0
and upgrading to this version is recommended.

The Java version of Akamai Download Manager is not affected by either
of these vulnerabilities.

These vulnerabilities exist only in the Download Manager client
software and do not affect Akamai's services in any way.


* Patch Instructions:

Affected users can upgrade to the latest version of Akamai Download
Manager by visiting the following web page:

http://dlm.tools.akamai.com/tools/upgrade.html

Visiting that page or any other Download Manager enabled page will
prompt the user to install the latest version of the software
automatically.  Akamai has successfully coordinated with each of our
enterprise customers to ensure that all are distributing the patched
version.

To verify the correct version is installed:

 1) In Internet Explorer, choose "Internet Options..." from the
    "Tools" menu.

 2) Under the "General" tab, select "Settings..." from the "Temporary
    Internet files" section.

 3) Select "View Objects..." from the "Temporary Internet files
    folder" section.

 4) Find the item for "DownloadManager Control" and verify that the
    version is "2,2,1,0" or higher.

 * If you wish to uninstall Download Manager, complete this last step:

 5) Find the item for "DownloadManager Control", right-click and
    select "Remove".

 6) When prompted to confirm, choose "Yes".



* Credit:

CVE-2007-1891 was independently discovered and brought to Akamai's
attention by both:

Fortinet (http://www.fortinet.com/)
iDefense (http://labs.idefense.com/)

CVE-2007-1892 was discovered by Akamai.


* Additional Information:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1891
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1892


* About Akamai:

Akamai® is the leading global service provider for accelerating
content and business processes online. Thousands of organizations have
formed trusted relationships with Akamai, improving their revenue and
reducing costs by maximizing the performance of their online
businesses. Leveraging the Akamai EdgePlatform, these organizations
gain business advantage today, and have the foundation for the
emerging Web solutions of tomorrow. Akamai is "The Trusted Choice for
Online Business." For more information, visit www.akamai.com.

- ----------------------------------------------------
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)

iQIVAwUBRiPXo0ngXEVbkoPOAQJJFxAAuSIaWM+HhUFSWXVCEXLPBpEzEVejD1L/
K3O1/rYp/p2jW9dMK4S54RaaOc+VK7IKie3SVWOlopzn8WNsjMRzoZSk//D5NXSH
TQ0F/nGad9IUUvclTtg2NuVEAE763zJ+Vrz33m2wMzGbTH4CkU2Pa1NOm27SGum9
9duaRWzblr6U/fXk4Ue0DTC2upUEFM8tHj2C6vyBo3RMH3W/6dQ50l3GqZnXIFEj
r2igtJGI2sav6t3OgZJpH/LlbKXm7Jjez2qqremLoawsU2wrL1YmUHQw+q/C+I5h
7w2euvf0cZE11se5aoMaVhfERFRbPDDpeu/HU0Mxsm/UNbygwYfv/5f0NrYilZ9z
JfR90RZRKBLWVPIKr62g0cdKjRRI3W/L1Mpr28ceJrFkSUMqzElswikxPthXrejx
vNnGwQvs4TlPAnrtRXMTKV7phMru+R71DQKwvA/eff9SPNU/bdJlcQjbl4suP0aN
kaXOH2hjFFpZIomeSDaK4vvhpG2bYHrEF2ZLTSfpbwvRCXbb5KQB3PnENWusLOku
ozP3TmAXFiAJVMu6xsYz9MhXsMLuRPELhP61HzRp5Ur1YjIMr7EVQKFX7ZiKg1IC
82vf+LjXXAAH2lThFzfkmeZY0uIZM46VN48Sje+A4mmZDkklNv6usWJdhU2z3JML
D1I0f4ctjns=
=sQgi
-----END PGP SIGNATURE-----