|
|
|
|
| |
Credit:
The information has been provided by iDefense.
The original article can be found at:
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=590
|
| |
Vulnerable Systems:
* Motorola Inc.'s Timbuktu Pro for Windows version 8.6.3.1367.
* (Older versions are suspected to be vulnerable).
The first issue exists within the handling of malformed application level protocol requests. Certain requests lead to an arbitrary length overflow of a buffer located on the heap.
The second vulnerability exists within the processing of log in requests. By specifying an overly long user name, it is possible to cause heap corruption.
The third vulnerability specifically exists within the "Scanner" functionally. By running a malicious socket server on TCP port 407, an attacker is able to cause a buffer overflow with a malformed "HELLO" response packet.
Exploitation of these vulnerabilities allows attackers to crash the Timbuktu Pro server or potentially execute arbitrary code with SYSTEM privileges.
In all cases, no authentication credentials are required to access the vulnerable code. In order to exploit the first two vulnerabilities, the attacker needs only the ability to initiate a session with the Timbuktu service. This service typically runs on TCP or UDP port 407.
The third vulnerability requires access to the local network since the problem lies in the handling of a response from a scanned server. Additionally, an attacker would need to persuade a user to attempt to connect to the malicious server.
Workaround:
Employing firewalls to limit access to the affected service's open ports (TCP and UDP port 407) can help prevent potential exposure to these vulnerabilities.
Vendor Status:
Motorola Inc. has addressed these vulnerabilities by releasing version 8.6.5 of Timbuktu Pro for Windows. For more information, consult the release notes at the following URL.
ftp://ftp-xo.netopia.com/evaluation/docs/timbuktu/win/865/relnotes/TB2Win865Evalrn.pdf
CVE Information:
CVE-2007-4221
Disclosure Timeline:
* 07/18/2007 - Initial vendor notification
* 07/19/2007 - Initial vendor response
* 08/27/2007 - Coordinated public disclosure
|
|
|
|
|
