TIBCO Rendezvous Bugs Disclose Potentially Sensitive Information and Let Remote Users Deny Service
|
|
SecurityTracker Alert ID: 1018512 |
|
SecurityTracker URL: http://securitytracker.com/id/1018512
|
|
CVE Reference:
CVE-2007-4158, CVE-2007-4159, CVE-2007-4160, CVE-2007-4161, CVE-2007-4162
(Links to External Site)
|
Date: Aug 6 2007
|
Impact:
Denial of service via network, Disclosure of system information, Disclosure of user information, Modification of user information
|
|
Version(s): 7.5.2, possibly other versions
|
Description:
Several vulnerabilities were reported in TIBCO Rendezvous. A remote user can cause denial of service conditions. A remote user can obtain potentially sensitive information.
A remote user can send specially crafted data to consume excessive memory resources on the target system.
A remote user may be able to send a specially crafted subject name to cause system instability when the '-no-lead-wc' switch is omitted.
A remote user may be able to capture inter-daemon communications and spoof messages.
A remote user can determine potentially sensitive information, including user names and IP address.
Andy Davis and Phil Huggins of Information Risk Management reported these vulnerabilities.
The original advisory is available at:
http://www.irmplc.com/content/pdfs/Security_Testing_Enterprise_Messaging_Systems.pdf
|
Impact:
A remote user can cause denial of service conditions.
A remote user may be able to spoof messages.
A remote user can obtain potentially sensitive information.
|
Solution:
No solution was available at the time of this entry.
|
Vendor URL: www.tibco.com/ (Links to External Site)
|
Cause:
Access control error, Input validation error, Not specified
|
Underlying OS: Linux (Any), OS/400, UNIX (AIX), UNIX (FreeBSD), UNIX (HP/UX), UNIX (Open UNIX-SCO), UNIX (Solaris - SunOS), UNIX (Tru64), Windows (2000), Windows (2003), Windows (XP)
|
|
Message History:
None.
|
Source Message Contents
|
|
|
[Original Message Not Available for Viewing]
|
|
