full-disclosure - IRM025: TIBCO Rendezvous RVD Daemon Remote Memory Leak DoS

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <7B01ACCEDD4FFE48B12A55E2DB16A93026C84F@dccheltenham.local.irmplc.com>
Date: Thu, 29 Nov 2007 12:31:16 -0000
From: "IRM Research" <research@...plc.com>
To: <bugtraq@...urityfocus.com>,
	<full-disclosure@...ts.grok.org.uk>
Subject: IRM025: TIBCO Rendezvous RVD Daemon Remote Memory
	Leak DoS

--------------------------------------------------------
IRM Security Advisory 025

TIBCO Rendezvous RVD Daemon Remote Memory Leak DoS 

Vulnerability Type / Importance: Remote DoS / High

Problem Discovered: 16 April 2007
Vendor Contacted: 16 April 2007
Advisory Published: 29 November 2007
--------------------------------------------------------
http://www.irmplc.com/index.php/160-Advisory-025
--------------------------------------------------------

Abstract:

The TIBCO Rendezvous RVD daemon is vulnerable to a memory leak, which
when remotely triggered, prevents any further RV communication until the
daemon is manually restarted.

Description:

The RV daemon (RVD) within TIBCO's Rendezvous messaging product is
responsible for the communication of messages between RV-enabled
applications. The vulnerability exists as the result of an error in the
code that parses information within one of the headers in a TIBCO
proprietary network protocol packet. 

Technical Details:

Within a Rendezvous "wire format" TCP packet, the first four bytes
represent the number of bytes of data to expect within the packet, for
example:

"\x00\x00\x00\x7c" //total length of data in packet
"\x99\x55\xee\xaa" // "magic" number
"\x06" // number of following bytes including null
"\x6d\x74\x79\x70\x65\x00" //the text "mtype"
...etc

In the above example the number of data bytes in the packet is "0x7c",
or 124 bytes. If this value is set to zero in a packet sent to the RVD
daemon then it stops responding to all subsequent communication. This
appears to result from a memory leak, which continues to attempt to
allocate memory. Eventually, operating system alert messages start to
appear, warning that the virtual memory in the underlying operating
system is running low.

Vendor & Patch Information:

TIBCO have fixed this issue in Rendezvous 8.0. The issue is documented
as being fixed in the release notes as follows:  

1-84MR37 - Fixed a daemon memory growth defect associated with messages
of length zero

Workaround:

There are no known workarounds for this vulnerability 

Tested/Affected Versions:

IRM confirmed the presence of this vulnerability in Rendezvous versions
7.5.2, 7.5.3 and 7.5.4

Credits:

Research & Advisory: Varun Uppal and Andy Davis

About IRM:

Information Risk Management Plc (IRM) is a vendor independent
information risk consultancy, founded in 1998. IRM has become a leader
in client side risk assessment, technical level auditing and in the
research and development of security vulnerabilities and tools. IRM is
headquartered in London with Technical Centres in Europe and Asia as
well as Regional Offices in the Far East and North America. Please visit
our website at www.irmplc.com for further information.

Disclaimer:

All information in this advisory is provided on an 'as is' basis in the
hope that it will be useful. Information Risk Management Plc is not
responsible for any risks or occurrences caused by the application of
this information.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/