Symark PowerBroker Client Multiple Local Buffer Overflow Vulnerabilities

Bugtraq ID:	28015
Class:	Boundary Condition Error
CVE:	CVE-2008-1056
Remote:	No
Local:	Yes
Published:	Feb 26 2008 12:00AM
Updated:	May 07 2015 05:32PM
Credit:	Michael Hale Ligh of MNIN.ORG and Greg Sinclair of NNL Software are credited with the discovery of these issues.
Vulnerable:	Symark PowerBroker 5.0.1 Symark PowerBroker 3.0 Symark PowerBroker 2.8 Symark PowerBroker 5.0 Symark PowerBroker 4.0 Symark PowerBroker 3.5 Symark PowerBroker 3.2
Not Vulnerable:

Symark PowerBroker Client Multiple Local Buffer Overflow Vulnerabilities

Symark PowerBroker Client is prone to multiple local buffer-overflow vulnerabilities because it fails to perform adequate boundary checks on user-supplied input. The issues affect the following setuid binaries: 'pbksh', 'pbsh', and 'pbrun'.

Attackers can exploit these issues to execute arbitrary code with superuser privileges. Successful exploits will completely compromise affected computers.

These issues affect PowerBroker Client 2.8 2.8 up to and including 5.0.1

Symark PowerBroker Client Multiple Local Buffer Overflow Vulnerabilities

Currently we are not aware of any exploits for these issues. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Symark PowerBroker Client Multiple Local Buffer Overflow Vulnerabilities

Solution:
The vendor released an advisory and fixes to address these issues. Please see the references for more information.

Symark PowerBroker Client Multiple Local Buffer Overflow Vulnerabilities

References:

• PowerBroker Homepage (Symark Software)
  
• PowerBroker February 2008 Security Update (Symark Software)
  
• Symark PowerBroker Security Advisory (NNL-Labs & MNIN)