TIBCO SmartSockets RTServer Multiple Remote Unspecified Loop Bounds Vulnerabilities

Bugtraq ID:	27293
Class:	Input Validation Error
CVE:	CVE-2007-5656
Remote:	Yes
Local:	No
Published:	Jan 15 2008 12:00AM
Updated:	Jan 16 2008 03:58PM
Credit:	McSlibin and Sean Larsson of VeriSign iDefense Labs are credited with discovering these issues.
Vulnerable:	TIBCO SmartSockets 6.8
Not Vulnerable:	TIBCO SmartSockets 6.8.1

TIBCO SmartSockets RTServer Multiple Remote Unspecified Loop Bounds Vulnerabilities

SmartSockets RTServer is prone to multiple unspecified remote code-execution vulnerabilities because it fails to adequately validate user-supplied input used to determine loop bounds.

Successfully exploiting these issues may allow attackers to execute code with SYSTEM privileges, facilitating the compromise of affected computers. Failed exploit attempts will likely crash the application.

These issues affect SmartSockets 6.8.0; other versions may also be affected.

TIBCO SmartSockets RTServer Multiple Remote Unspecified Loop Bounds Vulnerabilities

Currently we are not aware of any working exploits for these issues. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

TIBCO SmartSockets RTServer Multiple Remote Unspecified Loop Bounds Vulnerabilities

Solution:
The vendor has released updates to address these issues. Please see the references for more information.

TIBCO SmartSockets RTServer Multiple Remote Unspecified Loop Bounds Vulnerabilities

References:

• TIBCO SmartSockets Homepage (TIBCO)
  
• iDefense Security Advisory 01.15.08: TIBCO SmartSockets RTServer Multiple Untrus (iDefense Labs )
  
• iDefense Security Advisory 01.15.08: TIBCO SmartSockets RTServer Multiple Untrus (iDefense Labs)
  
• TIBCO SmartSockets Vulnerability (TIBCO)