Multiple Vendor Progress Server Heap Overflow VulnerabilityTPTI-07-12: July 12th, 2007
TippingPoint™ IPS Customer ProtectionTippingPoint IPS customers are protected against this vulnerability by Digital Vaccine protection filter ID 5326. For further product information on the TippingPoint IPS:
Vulnerability DetailsThis vulnerability allows attackers to execute arbitrary code on vulnerable installations of RSA Authentication Manager and other products that include the Progress server. User interaction is not required to exploit this vulnerability.
The specific flaw exists in the Progress Server listening by default on TCP ports 5520 and 5530. The _mprosrv.exe process trusts a user-supplied DWORD size and attempts to receive that amount of data into a statically allocated heap buffer.
The user-supplied size parameter is used directly as an argument to recv() as shown below:
0044F24F mov eax, [esp+42Ch+buf] ; 1012 byte heap buffer
0044F253 push 0 ; flags
0044F255 push esi ; attacker-controlled size
0044F256 push eax ; 1012 byte heap buffer
0044F257 push edi ; s
0044F258 call recv
The heap buffer which is received into is 1012 bytes. Sending more than 1012 bytes will overflow into subsequent heap chunks. This heap corruption can be leveraged by an attacker to execute arbitrary code in the context of the SYSTEM user.
Progress Software states: Progress Software has released an update for this issue through our partners. EMC/RSA information is listed below. Other vendors may be affected. For additional information, please contact Progress Technical Support and reference Support ID: P123949.
RSA Security states: RSA has made hot fixes available to registered users through RSA Customer Support. For more information, please visit the RSA website for the appropriate product:
For RSA ACE/Server 5.2, apply the following hot fix on top of Patch 1:
For RSA Authentication Manager 6.0, apply the following hot fix on top of the Patch 2 - (scroll down to the second half of the page)
For RSA SecurID Appliance 2.0, apply the following hot fix on top of the Upgrade 2.0.1:
For RSA Authentication Manager 6.1, apply the 6.1.2 patch:
RSA recommends that all customers using RSA ACE/Server 5.2, RSA Authentication Manager 6.0 and 6.1, and RSA SecurID Appliance 2.0 install the hot fixes. Notification was recently (June 28, 2007) sent to RSA SecurCare customers about the vulnerability and the correct way to resolve it.
2007-03-14 - Vulnerability reported to vendor
2007-07-12 - Coordinated public release of advisory