TippingPoint Digital Vaccine Laboratories

Multiple Vendor Progress Server Heap Overflow Vulnerability

TPTI-07-12: July 12th, 2007

CVE ID

Affected Vendors

Affected Products

TippingPoint™ IPS Customer Protection

TippingPoint IPS customers are protected against this vulnerability by Digital Vaccine protection filter ID 5326. For further product information on the TippingPoint IPS:

Vulnerability Details

This vulnerability allows attackers to execute arbitrary code on vulnerable installations of RSA Authentication Manager and other products that include the Progress server. User interaction is not required to exploit this vulnerability.

The specific flaw exists in the Progress Server listening by default on TCP ports 5520 and 5530. The _mprosrv.exe process trusts a user-supplied DWORD size and attempts to receive that amount of data into a statically allocated heap buffer.

The user-supplied size parameter is used directly as an argument to recv() as shown below:

_mprosrv.exe:
0044F24F mov eax, [esp+42Ch+buf] ; 1012 byte heap buffer
0044F253 push 0 ; flags
0044F255 push esi ; attacker-controlled size
0044F256 push eax ; 1012 byte heap buffer
0044F257 push edi ; s
0044F258 call recv

The heap buffer which is received into is 1012 bytes. Sending more than 1012 bytes will overflow into subsequent heap chunks. This heap corruption can be leveraged by an attacker to execute arbitrary code in the context of the SYSTEM user.

Vendor Response


Progress Software states: Progress Software has released an update for this issue through our partners. EMC/RSA information is listed below. Other vendors may be affected. For additional information, please contact Progress Technical Support and reference Support ID: P123949.

RSA Security states: RSA has made hot fixes available to registered users through RSA Customer Support. For more information, please visit the RSA website for the appropriate product:

For RSA ACE/Server 5.2, apply the following hot fix on top of Patch 1:

https://knowledge.rsasecurity.com/dlcpages/rsa_securid/securid_dlc_as52p.asp

For RSA Authentication Manager 6.0, apply the following hot fix on top of the Patch 2 - (scroll down to the second half of the page)

https://knowledge.rsasecurity.com/dlcpages/rsa_securid/securid_dlc_am60p2.asp

For RSA SecurID Appliance 2.0, apply the following hot fix on top of the Upgrade 2.0.1:

https://knowledge.rsasecurity.com/dlcpages/rsa_securid/securid_dlc_app.asp

For RSA Authentication Manager 6.1, apply the 6.1.2 patch:

https://knowledge.rsasecurity.com/dlcpages/rsa_securid/securid_dlc_am60p2.asp

RSA recommends that all customers using RSA ACE/Server 5.2, RSA Authentication Manager 6.0 and 6.1, and RSA SecurID Appliance 2.0 install the hot fixes. Notification was recently (June 28, 2007) sent to RSA SecurCare customers about the vulnerability and the correct way to resolve it.

Disclosure Timeline

    2007-03-14 - Vulnerability reported to vendor
    2007-07-12 - Coordinated public release of advisory

Credit

This vulnerability was discovered by: