[NT] Ipswitch WhatsUp Gold Remote Buffer Overflow Vulnerability

From: SecuriTeam (support_at_securiteam.com)
Date: 08/26/04

  • Next message: SecuriTeam: "[NT] NtRegmon Local Denial of Service" 
    To: list@securiteam.com
Date: 26 Aug 2004 10:52:01 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    The SecuriTeam alerts list - Free, Accurate, Independent.

    Get your security news from a reliable source.
    http://www.securiteam.com/mailinglist.html

    - - - - - - - - -

      Ipswitch WhatsUp Gold Remote Buffer Overflow Vulnerability
    ------------------------------------------------------------------------

    SUMMARY

    Ipswitch WhatsUp Gold is "a Microsoft Windows based network monitoring
    application". WhatsUp Gold allows attackers to execute arbitrary code
    under the privileges of the user that instantiated the application.

    DETAILS

    Vulnerable Systems:
     * WhatsUp Gold version 8.03

    Immune Systems:
     * WhatsUp Gold version 8.03 Hotfix 1

    Remote exploitation of a buffer overflow vulnerability in IpSwitch Inc.'s
    WhatsUp Gold allows attackers to execute arbitrary code under the
    privileges of the user that instantiated the application.

    The problem specifically exists in the _maincfgret.cgi script accessible
    through the web server installed by WhatsUp Gold. By posting a long string
    for the value of 'instancename', a buffer overflow occurs allowing an
    attacker to redirect the flow of control and eventually execute arbitrary
    code.

    Analysis:
    Successful exploitation allows remote attackers to execute arbitrary code
    under the privileges of the user that instantiated the application. The
    WhatsUp Gold web server is not enabled by default.

    Workaround:
    Disable the WhatsUp Gold web server if it is not required.

    Vendor Status:
    The buffer overflow is repaired in WhatsUp Gold, version 8.03 Hotfix 1.

    CVE Information:
     <http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0798>
    CAN-2004-0798

    ADDITIONAL INFORMATION

    The information has been provided by
    <mailto:idlabs-advisories@idefense.com> iDEFENSE.
    The original article can be found at:
    <http://www.idefense.com/application/poi/display?id=133&type=vulnerabilities> http://www.idefense.com/application/poi/display?id=133&type=vulnerabilities

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

  • Next message: SecuriTeam: "[NT] NtRegmon Local Denial of Service"

    Relevant Pages