Lumension Security Lumension Device Control Memory Corruption Vulnerability

Bugtraq ID:	47952
Class:	Unknown
CVE:
Remote:	Yes
Local:	No
Published:	May 24 2011 12:00AM
Updated:	Aug 24 2011 05:40PM
Credit:	Andy Davis of NGS Secure
Vulnerable:	Lumension Security Lumension Device Control 4.4 Lumension Security Lumension Device Control 4.2.2 Lumension Security Lumension Device Control 4.4 SR6
Not Vulnerable:	Lumension Security Lumension Device Control 4.4 SR7

Lumension Security Lumension Device Control Memory Corruption Vulnerability

Lumension Security Lumension Device Control (formerly Sanctuary) is prone to a memory-corruption vulnerability.

An attacker can exploit this issue to cause a denial-of-service condition. Due to the nature of this issue, remote code execution is possible but has not been confirmed.

Lumension Device Control 4.4 SR6 is vulnerable; other versions may also be affected.

Lumension Security Lumension Device Control Memory Corruption Vulnerability

The following exploit code is available:

• /data/vulnerabilities/exploits/47952.py

Lumension Security Lumension Device Control Memory Corruption Vulnerability

Solution:
Updates are available. Please contact the vendor for more information.

Lumension Security Lumension Device Control Memory Corruption Vulnerability

References:

• SXS Server Crash due to unhandled exception error (Lumension)
  
• Lumension Device Control Homepage (Lumension Security)
  
• NGS00054 Patch Notification: Lumension Device Control (formerly Sanctuary) remo ("Research@NGSSecure" )
  
• (NGS00054 Technical Advisory: : Lumension Device Control (formerly Sanctuary) re (research)