bugtraq - Re: Correction to: ZDI-10-151: SAP Crystal Reports 2008 GIOP Message Size Integer Overflow Remote Code Execution Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Fri, 13 Aug 2010 10:26:43 -0400
From: Steve Shockley <steve.shockley@...ckley.net>
To: ZDI Disclosures <zdi-disclosures@...pingpoint.com>
Cc: "'bugtraq@...urityfocus.com'" <bugtraq@...urityfocus.com>
Subject: Re: Correction to: ZDI-10-151: SAP Crystal Reports 2008 GIOP Message
 Size Integer Overflow Remote Code Execution Vulnerability

On 8/11/2010 12:12 PM, ZDI Disclosures wrote:
> The specific flaw exists within the ebus-3-3-2-6.dll module responsible for parsing GIOP requests for multiple processes.

Does this affect only version 3.3.2.6?

> -- Vendor Response:
> SAP has issued an update to correct this vulnerability. More details can be found at:
>
> https://service.sap.com/sap/support/notes/1473327

Do they have a public version of the advisory?  This one seems to 
require a login.