SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Security)  >   SilentRunner Vendors:   Raytheon
Raytheon SilentRunner Buffer Overflow Security Holes Let Remote Users Execute Arbitrary Code on the SilentRunner Server or Cause the Server to Crash
SecurityTracker Alert ID:  1002149
SecurityTracker URL:  http://securitytracker.com/id/1002149
CVE Reference:   CVE-2001-0636   (Links to External Site)
Updated:  Aug 8 2001
Original Entry Date:  Aug 7 2001
Impact:   Denial of service via network, Execution of arbitrary code via network, Root access via network, User access via network

Version(s): 2.0, 2.0.1; possibly earlier versions
Description:   Internet Security Systems reported that there are several buffer overflow vulnerabilities in Raytheon's SilentRunner network monitoring security software.

ISS reported that multiple buffer overflow vulnerabilities exist in the collector (cle.exe) component of SilentRunner that parses passwords for many common protocols such as POP, HTTP, FTP, etc.. This module reportedly does not perform bounds checking on user-supplied passwords. As a result, a remote user can use a long password string to cause the SilentRunner collector to crash. A remote user may also be able to cause arbitrary code to be executed by SilentRunner.

In addition, ISS reported that there is a buffer overflow vulnerability in the "Knowledge Browser" traffic analysis component of SilentRunner. The Knowledge Browser reportedly does not perform adequate bounds checking on certain long HTTP queries. A remote user can craft a long HTTP query such that, when the HTTP query is recorded by the SilentRunner collector and later processed by the Knowledge Browser, arbitrary code may be executed on the SilentRunner server.

Impact:   A remote user can cause the SilentRunner collector to crash and may be able to cause arbitrary code to be executed on the server with system level privileges.
Solution:   SilentRunner version 2.0.1 reportedly contains fixes for the long password overflow vulnerability but remains vulnerable to the long HTTP issue. Version 2.0 contains both vulnerabilities.
Vendor URL:  www.silentrunner.com/ (Links to External Site)
Cause:   Boundary error
Underlying OS:  Windows (2000), Windows (XP)

Message History:   None.


 Source Message Contents

Subject:  ISSalert: ISS Advisory: Multiple Buffer Overflow Vulnerabilities in Raytheon SilentRunner



TO UNSUBSCRIBE: email "unsubscribe alert" in the body of your message to
majordomo@iss.net  Contact alert-owner@iss.net for help with any problems!
---------------------------------------------------------------------------

-----BEGIN PGP SIGNED MESSAGE-----

Internet Security Systems Security Advisory
August 6, 2001

Multiple Buffer Overflow Vulnerabilities in Raytheon SilentRunner

Synopsis:

Internet Security Systems (ISS) X-Force in conjunction with ISS
Emergency Response Services (ERS) has discovered and researched remote
vulnerabilities in Raytheon SilentRunner. SilentRunner is a passive
network monitoring, discovery and analysis tool. The SilentRunner
collector module is the passive network monitoring component of the
program. The collector contains multiple buffer overflow
vulnerabilities that may be exploited by an attacker on networks
monitored by SilentRunner. Successful exploitation can result in a
Denial of Service (DoS) attack against the collector, or execution of
arbitrary code on the SilentRunner server.

Affected Versions:

Raytheon SilentRunner 2.0 
Raytheon SilentRunner 2.0.1

It is unknown at this time if previous versions of SilentRunner are
affected by the vulnerabilities described in this advisory. ISS X-Force
recommends that SilentRunner customers contact Raytheon to determine if
previous versions are vulnerable.

Description:

SilentRunner is an advanced network analysis system built on top of a
passive network monitoring engine. The collector monitors and records
network traffic for use within other portions of SilentRunner.
SilentRunner can view network activity through its own collector, or
import network data from various other sources. 

Multiple buffer overflow vulnerabilities exist in the collector
(cle.exe) component of SilentRunner. The routines that parse passwords
for many common protocols such as POP, HTTP, FTP, etc., do not perform
necessary bounds checking on user-supplied passwords. It is possible
for any user on any network monitored by a SilentRunner collector to
craft long strings that will crash the collector and possibly execute
arbitrary code on any system running the SilentRunner collector.

An additional buffer overflow vulnerability exists in the SilentRunner
"Knowledge Browser", a traffic analysis component of SilentRunner. The
Knowledge Browser does not perform adequate bounds checking on certain
long HTTP queries. Any user on a SilentRunner monitored network may
craft a long HTTP query, which will be recorded by the SilentRunner
collector. If the long HTTP query is processed by the Knowledge Browser,
malicious code may be executed on the SilentRunner server. Before the
Knowledge Browser can process traffic from the Silent Runner collector,
it must be manually started by a SilentRunner operator.

Recommendations:

Raytheon is aware of the vulnerabilities described in this advisory. 

SilentRunner version 2.0 is vulnerable to all issues described in this
advisory. SilentRunner version 2.0.1 contains fixes for the long
password overflow vulnerabilities described above. SilentRunner 2.0.1
remains vulnerable to the long HTTP issue.

ISS X-Force will provide detection and assessment support for these
vulnerabilities in upcoming X-Press Updates for RealSecure Network
Sensor and Internet Scanner.

Additional Information:

The Common Vulnerabilities and Exposures (CVE) project has assigned the
Name CAN-2001-0636 to this issue. This is a candidate for inclusion in
the CVE list (http://cve.mitre.org), which standardizes names for
security problems.

Credits:

ISS X-Force would like to thank John Ventura of ISS ERS for discovering
this vulnerability.

______

About Internet Security Systems (ISS)
Internet Security Systems is a leading global provider of security
management solutions for the Internet, protecting digital assets and
ensuring safe and uninterrupted e-business. With its industry-leading
intrusion detection and vulnerability assessment, remote managed
security services, and strategic consulting and education offerings, ISS
is a trusted security provider to more than 8,000 customers worldwide
including 21 of the 25 largest U.S. commercial banks and the top 10 U.S.
telecommunications companies. Founded in 1994, ISS is headquartered in
Atlanta, GA, with additional offices throughout North America and
international operations in Asia, Australia, Europe, Latin America and
the Middle East. For more information, visit the Internet Security
Systems web site at www.iss.net or call 888-901-7477.

Copyright (c) 2001 Internet Security Systems, Inc.

Permission is hereby granted for the redistribution of this Alert
electronically. It is not to be edited in any way without express
consent of the X-Force. If you wish to reprint the whole or any part
of this Alert in any other medium excluding electronic medium, please
e-mail xforce@iss.net for permission.

Disclaimer

The information within this paper may change without notice. Use of
this information constitutes acceptance for use in an AS IS condition.
There are NO warranties with regard to this information. In no event
shall the author be liable for any damages whatsoever arising out of or
in connection with the use or spread of this information. Any use of
this information is at the user's own risk.

X-Force PGP Key available at: http://xforce.iss.net/sensitive.php
as well as on MIT's PGP key server and PGP.com's key server.

Please send suggestions, updates, and comments to: X-Force
xforce@iss.net of Internet Security Systems, Inc.
-----BEGIN PGP SIGNATURE-----
Version: 2.6.3a
Charset: noconv

iQCVAwUBO28HXzRfJiV99eG9AQHrPQQAn9NJmX1/26qbOGOStu9YEAdduNVwFG3A
5sjMoqhUFIKBRkpgKLqGdWsDUVYgo8Dk5MiMIR1tsWAH+0v9xlxdYxsEBXito40z
Hq7GjxI/0Tz+x/Wqedolw0som3ka+ibw9QxkCaxBX+crLH/pweFup8Dq5imcYwZ0
2limL+eObYQ=
=6AIi
-----END PGP SIGNATURE-----


 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2021, SecurityGlobal.net LLC