full-disclosure - TSRT-07-04: LANDesk Management Suite Alert Service Stack Overflow Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <OFB683ECF9.97CF0EDB-ON882572BC.006C5DCC-882572BC.006C7B6D@3com.com>
Date: Fri, 13 Apr 2007 12:44:56 -0700
From: TSRT@...m.com
To: full-disclosure@...ts.grok.org.uk, bugtraq@...urityfocus.com
Subject: TSRT-07-04: LANDesk Management Suite Alert
 Service Stack Overflow Vulnerability

TSRT-07-04: LANDesk Management Suite Alert Service Stack Overflow
            Vulnerability
http://www.tippingpoint.com/security/advisories/TSRT-07-04.html
April 13, 2007

-- CVE ID:
CVE-2007-1674

-- Affected Vendor:
LANDesk

-- Affected Products:
Management Suite 8.7

-- TippingPoint(TM) IPS Customer Protection:
TippingPoint IPS customers have been protected against this
vulnerability since March 23, 2007 by Digital Vaccine protection
filter ID 5210. For further product information on the TippingPoint IPS:

    http://www.tippingpoint.com 

-- Vulnerability Details:
This vulnerability allows attackers to execute arbitrary code on
vulnerable installations of LANDesk Management Suite. User interaction
is not required to exploit this vulnerability.

The specific flaw exists in the Alert Service listening on UDP port
65535. The Aolnsrvr.exe process accepts user-supplied data and performs
an inline memory copy into a 268 byte stack-based buffer. Supplying
additional data results in a buffer overflow and SEH overwrite. The
vulnerable memory copy is shown here:

    0041EF49 mov edi, eax  ; edi pointer to stack buffer
    0041EF4B mov eax, ecx
    0041EF4D shr ecx, 2    ; total size of data
    0041EF50 rep movsd
    0041EF52 mov ecx, eax
    0041EF54 mov eax, ebx
    0041EF56 and ecx, 3
    0041EF59 rep movsb

Exploitation allows an attacker to execute arbitrary code under the
context of the SYSTEM user.

-- Vendor Response:
LANDesk has issued an update to correct this vulnerability. More details
can be found at:

http://kb.landesk.com/display/4n/kb/article.asp?aid=4142

-- Disclosure Timeline:
2007.03.08 - Vulnerability reported to vendor
2007.03.23 - Digital Vaccine released to TippingPoint customers
2007.04.13 - Coordinated public release of advisory

-- Credit:
This vulnerability was discovered by Aaron Portnoy, TippingPoint
Security Research Team.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/