The TIBCO Rendezvous RVD daemon is vulnerable to a memory leak, which when remotely triggered, prevents any further RV communication until the daemon is manually restarted.
Vulnerable Systems:
* Rendezvous versions 7.5.2, 7.5.3 and 7.5.4
Immune Systems:
* Rendezvous version 8.0
The RV daemon (RVD) within TIBCO's Rendezvous messaging product is responsible for the communication of messages between RV-enabled applications. The vulnerability exists as the result of an error in the code that parses information within one of the headers in a TIBCO proprietary network protocol packet.
Technical Details:
Within a Rendezvous "wire format" TCP packet, the first four bytes represent the number of bytes of data to expect within the packet, for example:
"\x00\x00\x00\x7c" //total length of data in packet
"\x99\x55\xee\xaa" // "magic" number
"\x06" // number of following bytes including null
"\x6d\x74\x79\x70\x65\x00" //the text "mtype"
...etc
In the above example the number of data bytes in the packet is "0x7c", or 124 bytes. If this value is set to zero in a packet sent to the RVD daemon then it stops responding to all subsequent communication. This appears to result from a memory leak, which continues to attempt to allocate memory. Eventually, operating system alert messages start to appear, warning that the virtual memory in the underlying operating system is running low.
Vendor & Patch Information:
TIBCO have fixed this issue in Rendezvous 8.0. The issue is documented as being fixed in the release notes as follows:
1-84MR37 - Fixed a daemon memory growth defect associated with messages of length zero
