TIBCO SmartSockets RTserver Stack Buffer Overflow Vulnerability

Bugtraq ID:	34754
Class:	Boundary Condition Error
CVE:	CVE-2009-1291
Remote:	Yes
Local:	No
Published:	Apr 28 2009 12:00AM
Updated:	Apr 29 2009 05:56PM
Credit:	Stephen Fewer of Harmony Security
Vulnerable:	TIBCO SmartSockets 6.8.1 TIBCO SmartSockets 6.8 TIBCO SmartSockets 6.0
Not Vulnerable:	TIBCO SmartSockets 6.8.2

TIBCO SmartSockets RTserver Stack Buffer Overflow Vulnerability

TIBCO SmartSockets is prone to a stack-based buffer-overflow vulnerability because the application fails to perform adequate boundary checks on user-supplied data.

Attackers can exploit this issue to execute arbitrary code with SYSTEM-level privileges, facilitating the complete compromise of affected computers. Failed exploit attempts will likely crash the affected application, denying service to legitimate users.

Versions prior to SmartSockets 6.8.2 are vulnerable.

TIBCO SmartSockets RTserver Stack Buffer Overflow Vulnerability

Currently we are not aware of any exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

TIBCO SmartSockets RTserver Stack Buffer Overflow Vulnerability

Solution:
The vendor has released updates and an advisory. Please see the references for more information.

TIBCO SmartSockets RTserver Stack Buffer Overflow Vulnerability

References:

• TIBCO SmartSockets Homepage (TIBCO)
  
• iDefense Security Advisory 04.28.09: TIBCO SmartSockets Stack Buffer Overflow Vu (iDefense Labs )
  
• TIBCO SmartSockets Stack Buffer Overflow Vulnerability (iDefense Labs)
  
• TIBCO SmartSockets vulnerability (TIBCO)