SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Security)  >   Fortinet FortiReporter Vendors:   Fortinet
(FortiNet Issues Fix for FortiReporter) eIQnetworks Enterprise Security Analyzer Buffer Overflows Let Remote Users Execute Arbitrary Code
SecurityTracker Alert ID:  1016610
SecurityTracker URL:  http://securitytracker.com/id/1016610
CVE Reference:   CVE-2006-3838   (Links to External Site)
Date:  Jul 31 2006
Impact:   Execution of arbitrary code via network, User access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): prior to 4.5.3
Description:   Several vulnerabilities were reported in eIQnetworks Enterprise Security Analyzer. A remote user can execute arbitrary code on the target system. FortiReporter is affected.

A remote user can send specially crafted data to trigger a buffer overflow and execute arbitrary code on the target system. The code will run with the privileges of the target service. Several components are affected.

The 'syslogserver.exe' process running on TCP port 10617 is vulnerable. UDP is not affected. The TCP configuration is not enabled by default. Long strings can trigger the overflow.

The 'monitoring.exe' process running on TCP port 9999 is affected.

The 'topology.exe' process running on TCP port 10628 is affected. Long prefixes to the GUIADDDEVICE, ADDDEVICE, or DELETEDEVICE commands can trigger the overflow.

The 'EnterpriseSecurityAnalyzer.exe' process running on TCP port 10616 is affected. Long arguments to the LICMGR_ADDLICENSE command can trigger the overflow.

The following OEM products are also affected:

Astaro Report Manager (OEM)
Fortinet FortiReporter (OEM)
iPolicy Security Reporter (OEM)
SanMina Viking Multi-Log Manager (OEM)
Secure Computing G2 Security Reporter (OEM)
Top Layer Network Security Analyzer (OEM)

The vendor was notified on May 10, 2006.

Titon, JxT, KF, and the rest of Bastard Labs and Cody Pierce of TippingPoint Security Research Team discovered these vulnerabilities.

The original advisories are available at:

http://www.zerodayinitiative.com/advisories/TSRT-06-03.html
http://www.zerodayinitiative.com/advisories/TSRT-06-04.html
http://www.zerodayinitiative.com/advisories/ZDI-06-023.html
http://www.zerodayinitiative.com/advisories/ZDI-06-024.html

Impact:   A remote user can execute arbitrary code on the target system.
Solution:   FortiReporter is affected by the eIQnetworks Enterprise Security Analyzer 'syslogserver.exe' vulnerability. FortiNet has issued a fix (4.5.3) for FortiReporter, available at:

http://www.fortinet.com/products/fortireporter.html

The FortiNet advisory is available at:

http://www.fortinet.com/FortiGuardCenter/advisory/FG-2006-23.html

Cause:   Boundary error
Underlying OS:  Windows (2000), Windows (2003)

Message History:   This archive entry is a follow-up to the message listed below.
Jul 26 2006 eIQnetworks Enterprise Security Analyzer Buffer Overflows Let Remote Users Execute Arbitrary Code



 Source Message Contents



[Original Message Not Available for Viewing]


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2022, SecurityGlobal.net LLC