SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (E-mail Client)  >   tsworks Vendors:   Fujitsu
Fujitsu tsworks Attachment Expansion Buffer Overflow May Permit Remote Code Execution
SecurityTracker Alert ID:  1008144
SecurityTracker URL:  http://securitytracker.com/id/1008144
CVE Reference:   GENERIC-MAP-NOMATCH   (Links to External Site)
Date:  Nov 11 2003
Impact:   Execution of arbitrary code via network, User access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 3.0
Description:   A buffer overflow vulnerability was reported in Fujitsu's tsworks e-mail client. A remote user can cause arbitrary code to be executed in certain cases.

Secure Net Service (SNS) warned that there is a buffer overflow vulnerability in tsworks that may allow a remote user to execute arbitrary code on the target system.

A remote user can reportedly send an e-mail message with an attachment that contains an "unusually long" string of characters to a target user. Then, when the target user attempts to invoke the "Expand the Attachment" function, the buffer overflow will be triggered, according to the report.

Hisayuki Shinmachi is credited with discovery.

The original SNS advisory is available at:

http://www.lac.co.jp/security/english/snsadv_e/70_e.html

Impact:   A remote user can send an attachment that, when expanded by the target user, will execute arbitrary code on the target user's computer. The code will run with the privileges of the target user.
Solution:   The vendor has reportedly issued a fixed version (3.1), available at:

http://www.hnc.fujitsu.com/products/tsworks/update.html#ver3101

Vendor URL:  www.hnc.fujitsu.com/products/tsworks/ (Links to External Site)
Cause:   Boundary error
Underlying OS:  Windows (Any)

Message History:   None.


 Source Message Contents

Subject:  http://www.lac.co.jp/security/english/snsadv_e/70_e.html


http://www.lac.co.jp/security/english/snsadv_e/70_e.html

Secure Net Service issued an advisory warning of a buffer overflow vulnerability in 
'tsworks' that may allow a remote user to execute arbitrary code on the target system.

A remote user can send an e-mail message with an attachment that contains an "unusually 
long" string of characters to a target user.  Then, when the target user attempts to 
invoke the "Expand the Attachment" function, the buffer overflow will be triggered.

Version 3.0 is reported to be vulnerable.

The vendor has reportedly issued a fixed version (3.1), available at:

http://www.hnc.fujitsu.com/products/tsworks/update.html#ver3101

Hisayuki Shinmachi is credited with discovery.




 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2021, SecurityGlobal.net LLC