[NT] Ipswitch WhatsUp Gold Remote Buffer Overflow Vulnerability
From: SecuriTeam (support_at_securiteam.com)
Date: 08/26/04
- Previous message: SecuriTeam: "[UNIX] CDE Mailer argv[0] Format String"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
To: list@securiteam.com Date: 26 Aug 2004 10:52:01 +0200
The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
Ipswitch WhatsUp Gold Remote Buffer Overflow Vulnerability
------------------------------------------------------------------------
SUMMARY
Ipswitch WhatsUp Gold is "a Microsoft Windows based network monitoring
application". WhatsUp Gold allows attackers to execute arbitrary code
under the privileges of the user that instantiated the application.
DETAILS
Vulnerable Systems:
* WhatsUp Gold version 8.03
Immune Systems:
* WhatsUp Gold version 8.03 Hotfix 1
Remote exploitation of a buffer overflow vulnerability in IpSwitch Inc.'s
WhatsUp Gold allows attackers to execute arbitrary code under the
privileges of the user that instantiated the application.
The problem specifically exists in the _maincfgret.cgi script accessible
through the web server installed by WhatsUp Gold. By posting a long string
for the value of 'instancename', a buffer overflow occurs allowing an
attacker to redirect the flow of control and eventually execute arbitrary
code.
Analysis:
Successful exploitation allows remote attackers to execute arbitrary code
under the privileges of the user that instantiated the application. The
WhatsUp Gold web server is not enabled by default.
Workaround:
Disable the WhatsUp Gold web server if it is not required.
Vendor Status:
The buffer overflow is repaired in WhatsUp Gold, version 8.03 Hotfix 1.
CVE Information:
<http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0798>
CAN-2004-0798
ADDITIONAL INFORMATION
The information has been provided by
<mailto:idlabs-advisories@idefense.com> iDEFENSE.
The original article can be found at:
<http://www.idefense.com/application/poi/display?id=133&type=vulnerabilities> http://www.idefense.com/application/poi/display?id=133&type=vulnerabilities
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.
- Previous message: SecuriTeam: "[UNIX] CDE Mailer argv[0] Format String"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
- [NT] Ipswitch WhatsUp Gold prn.htm DoS
... The following security advisory is sent to the securiteam mailing list, and can be
found at the SecuriTeam web site: http://www.securiteam.com ... Ipswitch Inc.'s WhatsUp
Gold allows attackers to cause the application to ... 08/12/2004 Initial vendor response
... (Securiteam) - [NT] Ipswitch Whatsup Multiple Vulnerabilities
... The following security advisory is sent to the securiteam mailing list, and can be
found at the SecuriTeam web site: http://www.securiteam.com ... * Ipswitch WhatsUp Gold
version 8.04 ... It is possible to view the source code of all files made public through
... Output from attack: ... (Securiteam) - [EXPL] Ipswitch WhatsUp Gold Remote Buffer Overflow Exploit
... The following security advisory is sent to the securiteam mailing list, and
can be found at the SecuriTeam web site: http://www.securiteam.com ... WhatsUp Gold Remote
Buffer Overflow Vulnerability, ... print $socket "Referer: ... (Securiteam) - [NT] Microsoft License Manager and urlmon.dll COM Object Interaction Invalid Memory Access Vulnerabi
... The following security advisory is sent to the securiteam mailing list, and can be
found at the SecuriTeam web site: http://www.securiteam.com ... Internet Explorer is "a
set of core technologies in Microsoft Windows ... exploitation of an invalid memory access
vulnerability in various ... COM objects may allow an attacker to execute arbitrary code.
... (Securiteam) - [NT] Kaspersky Labs Anti-Virus IOCTL Local Privilege Escalation
... The following security advisory is sent to the securiteam mailing list, and can be
found at the SecuriTeam web site: http://www.securiteam.com ... Kaspersky Labs Anti-Virus IOCTL
Local Privilege Escalation ... attackers can cause the driver to execute arbitrary
code ... (Securiteam)