Sophos TAO/Remote Management System (RMS) GIOP Message Remote Denial of Service Vulnerability

Bugtraq ID:	33313
Class:	Failure to Handle Exceptional Conditions
CVE:
Remote:	Yes
Local:	No
Published:	Jan 16 2009 12:00AM
Updated:	Jan 19 2009 06:32PM
Credit:	MWR InfoSecurity
Vulnerable:	Sophos Remote Management System (RMS) 3.0.8
Not Vulnerable:	Sophos Remote Management System (RMS) 3.0.9

Sophos TAO/Remote Management System (RMS) GIOP Message Remote Denial of Service Vulnerability

Sophos Remote Management System (RMS) is prone to a denial-of-service vulnerability because the application fails to handle very large or corrupt GIOP messages.

An attacker can exploit this issue to crash the affected application, denying service to legitimate users.

Versions prior to RMS 3.0.9 are vulnerable.

Sophos TAO/Remote Management System (RMS) GIOP Message Remote Denial of Service Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Sophos TAO/Remote Management System (RMS) GIOP Message Remote Denial of Service Vulnerability

Solution:
The vendor released an advisory and updates to address this issue. Please see the references for more information.

Sophos TAO/Remote Management System (RMS) GIOP Message Remote Denial of Service Vulnerability

References:

• Sophos Homepage (Sophos)
  
• Advisory: Minor TAO/Remote Management System (RMS) vulnerability fixed in Sophos (Sophos)