DESlock+ Local Buffer Overflow and Multiple Denial of Service Vulnerabilities

Bugtraq ID:	31273
Class:	Unknown
CVE:
Remote:	No
Local:	Yes
Published:	Sep 20 2008 12:00AM
Updated:	Sep 22 2008 05:49PM
Credit:	mu-b, NT Internals
Vulnerable:	Data Encryption Systems DESlock+ 3.2.7 Data Encryption Systems DESlock+ 3.2.6
Not Vulnerable:

DESlock+ Local Buffer Overflow and Multiple Denial of Service Vulnerabilities

DESlock+ is prone to multiple local vulnerabilities, including a buffer-overflow issue and multiple denial-of-service issues.

Local attackers can exploit these issues to execute arbitrary code with SYSTEM-level privileges or cause denial-of-service conditions.

These issues affect DESlock+ 3.2.7 and prior versions.

DESlock+ Local Buffer Overflow and Multiple Denial of Service Vulnerabilities

The following proofs of concept and exploits are available:

• /data/vulnerabilities/exploits/31237-deslock-overflow.c
• /data/vulnerabilities/exploits/31237-deslock-probe-race.c
• /data/vulnerabilities/exploits/31237-deslock-probe-read.c
• /data/vulnerabilities/exploits/31237-vdlptokn-dos.c

DESlock+ Local Buffer Overflow and Multiple Denial of Service Vulnerabilities

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

DESlock+ Local Buffer Overflow and Multiple Denial of Service Vulnerabilities

References:

• DESlock+ Homepage (Data Encryption Systems)