IBM Tivoli Provisioning Manager for OS Deployment Remote Buffer Overflow Vulnerability
BID:27387
Info
IBM Tivoli Provisioning Manager for OS Deployment Remote Buffer Overflow Vulnerability
| Bugtraq ID: | 27387 |
| Class: | Boundary Condition Error |
| CVE: |
CVE-2008-0401 |
| Remote: | Yes |
| Local: | No |
| Published: | Jan 22 2008 12:00AM |
| Updated: | Mar 06 2008 07:01PM |
| Credit: | iDefense reported this vulnerability. |
| Vulnerable: |
IBM Tivoli Provisioning Manager for OS Deployment 5.1 .3 IBM Tivoli Provisioning Manager for OS Deployment 5.1 .116 IBM Tivoli Provisioning Manager for OS Deployment 5.1 .116 IBM Tivoli Provisioning Manager for OS Deployment 5.1.0.2 |
| Not Vulnerable: |
IBM Tivoli Provisioning Manager for OS Deployment 5.1 3 Intirim Fix 3 |
Discussion
IBM Tivoli Provisioning Manager for OS Deployment Remote Buffer Overflow Vulnerability
IBM Tivoli Provisioning Manager for OS Deployment is prone to a remote buffer-overflow vulnerability because it fails to properly perform size checks on user-supplied input.
A remote attacker can exploit this issue to execute arbitrary code with SYSTEM-level privileges or to crash the server process, which could lead to denial-of-service conditions.
Versions prior to IBM Tivoli Provisioning Manager for OS Deployment 5.1.0.3 are vulnerable.
NOTE: This BID was previously titled 'IBM Tivoli Provisioning Manager for OS Deployment Denial of Service Vulnerability' but has been updated to reflect new information.
IBM Tivoli Provisioning Manager for OS Deployment is prone to a remote buffer-overflow vulnerability because it fails to properly perform size checks on user-supplied input.
A remote attacker can exploit this issue to execute arbitrary code with SYSTEM-level privileges or to crash the server process, which could lead to denial-of-service conditions.
Versions prior to IBM Tivoli Provisioning Manager for OS Deployment 5.1.0.3 are vulnerable.
NOTE: This BID was previously titled 'IBM Tivoli Provisioning Manager for OS Deployment Denial of Service Vulnerability' but has been updated to reflect new information.
Exploit / POC
IBM Tivoli Provisioning Manager for OS Deployment Remote Buffer Overflow Vulnerability
Currently we are not aware of any working exploits for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Currently we are not aware of any working exploits for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution / Fix
IBM Tivoli Provisioning Manager for OS Deployment Remote Buffer Overflow Vulnerability
Solution:
The vendor has addressed this issue in Interim Fix 3 (5.1.0-TIV-TPMOSD-IF0003). Please contact the vendor for details on obtaining and applying the appropriate updates. See the references for more information.
Solution:
The vendor has addressed this issue in Interim Fix 3 (5.1.0-TIV-TPMOSD-IF0003). Please contact the vendor for details on obtaining and applying the appropriate updates. See the references for more information.
References
IBM Tivoli Provisioning Manager for OS Deployment Remote Buffer Overflow Vulnerability
References:
References:
- IBM Tivoli PMfOSD HTTP Request Method Buffer Overflow Vulnerability (iDefense Labs)
- Tivoli Provisioning Manager for OS Deployment 5.1.0-TIV-TPMOSD-IF0003 (IBM)
- Tivoli Provisioning Manager for OS Deployment Product Page (IBM)
- Vulnerability Note VU#158609 (US-CERT)
- iDefense Security Advisory 01.22.08: IBM Tivoli PMfOSD HTTP Request Method Buf (iDefense Labs