Juniper Networks Juniper Installer Service Buffer Overflow Vulnerability

Bugtraq ID:	38232
Class:	Boundary Condition Error
CVE:
Remote:	Yes
Local:	No
Published:	Feb 13 2010 12:00AM
Updated:	Feb 16 2010 05:41PM
Credit:	Ruben Santamarta
Vulnerable:	Juniper Juniper Installer Service 1.0
Not Vulnerable:

Juniper Networks Juniper Installer Service Buffer Overflow Vulnerability

Juniper Installer Service is prone to a buffer-overflow vulnerability because it fails to sufficiently validate user-supplied data. A successful exploit may allow arbitrary code to run with SYSTEM privileges.

Note that a number of products (such as Juniper Odyssey Access Client) include the vulnerable component, which may be installed as 'dsInstallerService.dll'.

Juniper Networks Juniper Installer Service Buffer Overflow Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Juniper Networks Juniper Installer Service Buffer Overflow Vulnerability

Solution:
The vendor has released an update for customers with valid login credentials. Please see the references for more information.

Juniper Networks Juniper Installer Service Buffer Overflow Vulnerability

References:

• Juniper Installer Service Stack Buffer Overflow Vulnerability (iDefense)
  
• PSN-2009-10-540 (Juniper Networks)