[NT] Ipswitch WhatsUp Gold Remote Buffer Overflow Vulnerability

From: SecuriTeam (support_at_securiteam.com)
Date: 08/26/04

  • Next message: SecuriTeam: "[NT] NtRegmon Local Denial of Service" 
    To: list@securiteam.com
Date: 26 Aug 2004 10:52:01 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    The SecuriTeam alerts list - Free, Accurate, Independent.

    Get your security news from a reliable source.
    http://www.securiteam.com/mailinglist.html

    - - - - - - - - -

      Ipswitch WhatsUp Gold Remote Buffer Overflow Vulnerability
    ------------------------------------------------------------------------

    SUMMARY

    Ipswitch WhatsUp Gold is "a Microsoft Windows based network monitoring
    application". WhatsUp Gold allows attackers to execute arbitrary code
    under the privileges of the user that instantiated the application.

    DETAILS

    Vulnerable Systems:
     * WhatsUp Gold version 8.03

    Immune Systems:
     * WhatsUp Gold version 8.03 Hotfix 1

    Remote exploitation of a buffer overflow vulnerability in IpSwitch Inc.'s
    WhatsUp Gold allows attackers to execute arbitrary code under the
    privileges of the user that instantiated the application.

    The problem specifically exists in the _maincfgret.cgi script accessible
    through the web server installed by WhatsUp Gold. By posting a long string
    for the value of 'instancename', a buffer overflow occurs allowing an
    attacker to redirect the flow of control and eventually execute arbitrary
    code.

    Analysis:
    Successful exploitation allows remote attackers to execute arbitrary code
    under the privileges of the user that instantiated the application. The
    WhatsUp Gold web server is not enabled by default.

    Workaround:
    Disable the WhatsUp Gold web server if it is not required.

    Vendor Status:
    The buffer overflow is repaired in WhatsUp Gold, version 8.03 Hotfix 1.

    CVE Information:
     <http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0798>
    CAN-2004-0798

    ADDITIONAL INFORMATION

    The information has been provided by
    <mailto:idlabs-advisories@idefense.com> iDEFENSE.
    The original article can be found at:
    <http://www.idefense.com/application/poi/display?id=133&type=vulnerabilities> http://www.idefense.com/application/poi/display?id=133&type=vulnerabilities

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

  • Next message: SecuriTeam: "[NT] NtRegmon Local Denial of Service"

    Relevant Pages

    • [NT] Ipswitch WhatsUp Gold prn.htm DoS
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Ipswitch Inc.'s WhatsUp Gold allows attackers to cause the application to ... 08/12/2004 Initial vendor response ...
      (Securiteam)
    • [NT] Ipswitch Whatsup Multiple Vulnerabilities
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... * Ipswitch WhatsUp Gold version 8.04 ... It is possible to view the source code of all files made public through ... Output from attack: ...
      (Securiteam)
    • [EXPL] Ipswitch WhatsUp Gold Remote Buffer Overflow Exploit
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... WhatsUp Gold Remote Buffer Overflow Vulnerability, ... print $socket "Referer: ...
      (Securiteam)
    • [NT] Microsoft License Manager and urlmon.dll COM Object Interaction Invalid Memory Access Vulnerabi
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Internet Explorer is "a set of core technologies in Microsoft Windows ... exploitation of an invalid memory access vulnerability in various ... COM objects may allow an attacker to execute arbitrary code. ...
      (Securiteam)
    • [NT] Kaspersky Labs Anti-Virus IOCTL Local Privilege Escalation
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Kaspersky Labs Anti-Virus IOCTL Local Privilege Escalation ... attackers can cause the driver to execute arbitrary code ...
      (Securiteam)