HP-UX DCE swagentd buffer overflow
| hpux-dce-swagentd-bo (39018) |  High Risk |
Description:
HP-UX when running DCE is vulnerable to a buffer overflow, caused by improper bounds checking by the sw_rpc_agent_init function within swagentd. By sending specially-crafted arguments, a remote attacker could overwrite function pointers to overflow a buffer and execute arbitrary code on the system or cause the application to crash.
Platforms Affected:
- HP, HP-UX B.11.11
- HP, HP-UX B.11.23
Remedy:
Refer to HPSBUX02294 SSRT071451 rev.1 for patch, upgrade or suggested workaround information. See References.
Consequences:
Gain Access
References:
- HPSBUX02294 SSRT071451 rev.1, HP-UX Running DCE, Remote Denial of Service (DoS) at http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01294212&jumpid=reg_R1002_USEN.
- ZDI-07-079, Hewlett-Packard HP-UX swagentd Buffer Overflow Vulnerability at http://www.zerodayinitiative.com/advisories/ZDI-07-079.html.
- ASA-2007-529: HP-UX Running DCE, Remote Denial of Service (DoS) (HPSBUX02294)
- BID-26855: HP-UX DCE 'swgentd' Daemon Remote Arbitrary Code Execution Vulnerability
- CVE-2007-6195: Buffer overflow in the sw_rpc_agent_init function in swagentd in Software Distributor (SD), and possibly other DCE applications, in HP HP-UX B.11.11 and B.11.23 allows remote attackers to execute arbitrary code or cause a denial of service via malformed arguments in an opcode 0x04 DCE RPC request.
- SA28087: HP-UX DCE swagentd Buffer Overflow Vulnerability
- SECTRACK ID: 1019098: HP-UX DCE Lets Remote Users Deny Service
- VUPEN/ADV-2007-4220: HP-UX DCE Data Processing Remote Denial of Service Vulnerability
Reported:
Dec 12, 2007
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net