SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Generic)  >   TIBCO Rendezvous Vendors:   TIBCO Software
TIBCO Rendezvous Bugs Disclose Potentially Sensitive Information and Let Remote Users Deny Service
SecurityTracker Alert ID:  1018512
SecurityTracker URL:  http://securitytracker.com/id/1018512
CVE Reference:   CVE-2007-4158, CVE-2007-4159, CVE-2007-4160, CVE-2007-4161, CVE-2007-4162   (Links to External Site)
Date:  Aug 6 2007
Impact:   Denial of service via network, Disclosure of system information, Disclosure of user information, Modification of user information

Version(s): 7.5.2, possibly other versions
Description:   Several vulnerabilities were reported in TIBCO Rendezvous. A remote user can cause denial of service conditions. A remote user can obtain potentially sensitive information.

A remote user can send specially crafted data to consume excessive memory resources on the target system.

A remote user may be able to send a specially crafted subject name to cause system instability when the '-no-lead-wc' switch is omitted.

A remote user may be able to capture inter-daemon communications and spoof messages.

A remote user can determine potentially sensitive information, including user names and IP address.

Andy Davis and Phil Huggins of Information Risk Management reported these vulnerabilities.

The original advisory is available at:

http://www.irmplc.com/content/pdfs/Security_Testing_Enterprise_Messaging_Systems.pdf

Impact:   A remote user can cause denial of service conditions.

A remote user may be able to spoof messages.

A remote user can obtain potentially sensitive information.

Solution:   No solution was available at the time of this entry.
Vendor URL:  www.tibco.com/ (Links to External Site)
Cause:   Access control error, Input validation error, Not specified
Underlying OS:  Linux (Any), OS/400, UNIX (AIX), UNIX (FreeBSD), UNIX (HP/UX), UNIX (Open UNIX-SCO), UNIX (Solaris - SunOS), UNIX (Tru64), Windows (2000), Windows (2003), Windows (XP)

Message History:   None.


 Source Message Contents



[Original Message Not Available for Viewing]


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2020, SecurityGlobal.net LLC