TIBCO SmartSockets Untrusted Pointer Multiple Remote Code Execution Vulnerabilities
BID:27292
Info
TIBCO SmartSockets Untrusted Pointer Multiple Remote Code Execution Vulnerabilities
| Bugtraq ID: | 27292 |
| Class: | Boundary Condition Error |
| CVE: |
CVE-2007-5655 |
| Remote: | Yes |
| Local: | No |
| Published: | Jan 15 2008 12:00AM |
| Updated: | Jan 16 2008 04:28PM |
| Credit: | McSlibin and Sean Larsson of VeriSign iDefense Labs are credited with discovering these issues. |
| Vulnerable: |
TIBCO SmartSockets Product Family (RTworks) 4.0.3 TIBCO SmartSockets 6.8 |
| Not Vulnerable: |
TIBCO SmartSockets Product Family (RTworks) 4.0.4 TIBCO SmartSockets 6.8.1 |
Discussion
TIBCO SmartSockets Untrusted Pointer Multiple Remote Code Execution Vulnerabilities
TIBCO SmartSockets is prone to multiple remote code-execution vulnerabilities.
Attackers can exploit these issues to execute arbitrary code with SYSTEM-level privileges, facilitating in the complete compromise of affected computers. Failed exploit attempts will likely crash the affected application.
The following components are affected:
TIBCO RTworks Server (rtserver)
TIBCO RTworks Data Archive Process (rtarchive)
TIBCO RTworks Data Playback Process (rtplayback)
TIBCO RTworks Data Acquisi- TIon Process (rtdaq)
TIBCO RTworks Human Computer Interface (rthci)
TIBCO RTworks Inference Engine (r- TIe)
TIBCO RTworks libraries (r- TIpc, rtu- TIl)
TIBCO SmartSockets is prone to multiple remote code-execution vulnerabilities.
Attackers can exploit these issues to execute arbitrary code with SYSTEM-level privileges, facilitating in the complete compromise of affected computers. Failed exploit attempts will likely crash the affected application.
The following components are affected:
TIBCO RTworks Server (rtserver)
TIBCO RTworks Data Archive Process (rtarchive)
TIBCO RTworks Data Playback Process (rtplayback)
TIBCO RTworks Data Acquisi- TIon Process (rtdaq)
TIBCO RTworks Human Computer Interface (rthci)
TIBCO RTworks Inference Engine (r- TIe)
TIBCO RTworks libraries (r- TIpc, rtu- TIl)
Exploit / POC
TIBCO SmartSockets Untrusted Pointer Multiple Remote Code Execution Vulnerabilities
Currently we are not aware of any exploits for these issues. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Currently we are not aware of any exploits for these issues. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution / Fix
TIBCO SmartSockets Untrusted Pointer Multiple Remote Code Execution Vulnerabilities
Solution:
The vendor released updates and an advisory to address these issues. Please see the references for more information.
Solution:
The vendor released updates and an advisory to address these issues. Please see the references for more information.
References
TIBCO SmartSockets Untrusted Pointer Multiple Remote Code Execution Vulnerabilities
References:
References:
- TIBCO SmartSockets Homepage (TIBCO)
- iDefense Security Advisory 01.15.08: TIBCO SmartSockets RTServer Multiple Untrus (iDefense Labs
- TIBCO SmartSockets Product Family (RTworks) vulnerability (TIBCO)
- TIBCO SmartSockets RTServer Multiple Untrusted Pointer Vulnerabilities (iDefense Labs)
- TIBCO SmartSockets Vulnerability (TIBCO)