eEye Retina WiFi Scanner '.rws' File Buffer Overflow Vulnerability

Bugtraq ID:	35624
Class:	Boundary Condition Error
CVE:	CVE-2009-3859
Remote:	Yes
Local:	No
Published:	Jul 10 2009 12:00AM
Updated:	Apr 13 2015 09:09PM
Credit:	Gjoko 'LiquidWorm' Krstic
Vulnerable:	Eeye Retina WiFi Scanner 1.0.8 .68 Eeye Retina Network Security Scanner 5.10.14
Not Vulnerable:	Eeye Retina Network Security Scanner 5.10.15

eEye Retina WiFi Scanner '.rws' File Buffer Overflow Vulnerability

eEye Retina WiFi Scanner is prone to a buffer-overflow vulnerability because the application fails to perform adequate boundary checks on user-supplied input.

Attackers may leverage this issue to execute arbitrary code in the context of the application. Failed attacks will cause denial-of-service conditions.

eEye Retina WiFi Scanner 1.0.8.68 is vulnerable; other versions may also be affected.

eEye Retina WiFi Scanner '.rws' File Buffer Overflow Vulnerability

Core Security Technologies has developed a working commercial exploit for its CORE IMPACT product. This exploit is not otherwise publicly available or known to be circulating in the wild.

The following proof of concept is available:

• /data/vulnerabilities/exploits/35624.py

eEye Retina WiFi Scanner '.rws' File Buffer Overflow Vulnerability

Solution:
The vendor has released an advisory and updates. Please see the references for details.

eEye Retina WiFi Scanner '.rws' File Buffer Overflow Vulnerability

References:

• eEye Digital Security Team Home Page (eEye)
  
• Retina WiFi Security Scanner 1.0 (.rws parsing) Buffer Overflow Vulnerability (Gjoko 'LiquidWorm' Krstic)
  
• AD20090710 eEye Retina Wireless Scanner .RWS File Processing Memory Corruption (eEye )