TIBCO Rendezvous Bugs Disclose Potentially Sensitive Information and Let Remote Users Deny Service
|
|
SecurityTracker Alert ID: 1018512
|
|
SecurityTracker URL: http://securitytracker.com/id?1018512
|
|
CVE Reference: CVE-2007-4158
, CVE-2007-4159
, CVE-2007-4160
, CVE-2007-4161
, CVE-2007-4162
(Links to External Site)
|
Date: Aug 6 2007
|
Impact: Denial of service via network, Disclosure of system information, Disclosure of user information, Modification of user information
|
Version(s): 7.5.2, possibly other versions
|
Description: Several vulnerabilities were reported in TIBCO Rendezvous. A remote user can cause denial of service conditions. A remote user can obtain potentially sensitive information.
A remote user can send specially crafted data to consume excessive memory resources on the target system.
A remote user may be
able to send a specially crafted subject name to cause system instability when the '-no-lead-wc' switch is omitted.
A remote
user may be able to capture inter-daemon communications and spoof messages.
A remote user can determine potentially sensitive
information, including user names and IP address.
Andy Davis and Phil Huggins of Information Risk Management reported these vulnerabilities.
The
original advisory is available at:
http://www.irmplc.com/content/pdfs/Security_Testing_Enterprise_Messaging_Systems.pdf
|
Impact: A remote user can cause denial of service conditions.
A remote user may be able to spoof messages.
A remote user can obtain potentially sensitive information.
|
Solution: No solution was available at the time of this entry.
|
Vendor URL: www.tibco.com/ (Links to External Site)
|
Cause: Access control error, Input validation error, Not specified
|
Underlying OS: Linux (Any), OS/400, UNIX (AIX), UNIX (FreeBSD), UNIX (HP/UX), UNIX (Open UNIX-SCO), UNIX (Solaris - SunOS), UNIX (Tru64), Windows (2000), Windows (2003), Windows (XP)
|
|
Message History:
None.
|
Source Message Contents
|
Date: Mon, 6 Aug 2007 00:06:52 -0400
Subject: TIBCO Rendezvous
|
http://www.irmplc.com/content/pdfs/Security_Testing_Enterprise_Messaging_Systems.pdf
CVE-2007-4158
CVE-2007-4159
CVE-2007-4160
CVE-2007-4161
CVE-2007-4162
|
|
