SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (VPN)  >   SafeNet SoftRemote Vendors:   SafeNet
SafeNet SoftRemote Buffer Overflow in Processing Policy Files May Let Local Users Gain Elevated Privileges
SecurityTracker Alert ID:  1023117
SecurityTracker URL:  http://securitytracker.com/id/1023117
CVE Reference:   CVE-2009-3861   (Links to External Site)
Updated:  Nov 18 2009
Original Entry Date:  Oct 30 2009
Impact:   Execution of arbitrary code via local system, User access via local system
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): Tested on 10.8.5 (Build 2), 10.3.5 (Build 6)
Description:   A vulnerability was reported in SafeNet SoftRemote. A local user may be able to obtain elevated privileges on the target system.

A local user with the ability to set specially crafted 'TREENAME' or 'GROUPNAME' values in the spd files can trigger a stack overflow and execute arbitrary code. The code will run with the privileges of the SoftRemote client.

Brett Gervasoni from SOS Labs reported this vulnerability.

Impact:   A local user may be able to obtain elevated privileges on the target system.
Solution:   The vendor has issued a fix (10.8.9).
Vendor URL:  safenet-inc.com/ (Links to External Site)
Cause:   Boundary error
Underlying OS:  Windows (Any)

Message History:   None.


 Source Message Contents

Subject:  SafeNet SoftRemote Local Buffer Overflow - Security Advisory - SOS-09-008

SafeNet SoftRemote Local Buffer Overflow - Security Advisory - SOS-09-008


Release Date.                  30-Oct-2009
Vendor Notification Date.      20-Jul-2009
Product.                       SafeNet SoftRemote
Platform.                      Microsoft Windows
Affected versions.             10.8.5 (Build 2), 10.3.5 (Build 6)
                               verified and possibly others.
                               Other vendors which have OEM'd the
                               client.
Severity Rating.               High
Impact.                        System access
Attack Vector.                 Local
Solution Status.               Fixed in 10.8.9 (unverified)
CVE reference.                 Not currently assigned

Details.
SafeNet SoftRemote is an IPsec VPN client that sets up a secure
channel for data transport. The application is a popular VPN client
which has been OEM'd by many other companies. As a result this
vulnerability affects a number of products and vendors.

SafeNet SoftRemote is vulnerable to a local stack based buffer overflow
which can lead to the compromise of a vulnerable system.

The vulnerability is caused due to a boundary error when processing
certain sections of spd (policy) files. Passing an overly long
string to either "TREENAME" or "GROUPNAME" will trigger the
overflow. Successful exploitation results in the execution of
arbitrary code.

Solution.
Fixed in 10.8.9 (unverified).

Discovered by.
Brett Gervasoni from SOS Labs.

About us.

Sense of Security is a leading provider of information security and risk 
management solutions. Our team has expert skills in assessment and 
assurance, strategy and architecture, and deployment through to ongoing 
management. We are Australia's premier application penetration testing firm 
and trusted IT security advisor to many of the countries largest 
organisations.

Sense of Security Pty Ltd

Level 3, 66 King St
Sydney NSW 2000
AUSTRALIA

T: +61 (0)2 9290 4444
F: +61 (0)2 9290 4455
W: http://www.senseofsecurity.com.au
E: info@senseofsecurity.com.au
Twitter: ITsecurityAU

The latest version of this advisory can be found at:
http://www.senseofsecurity.com.au/advisories/SOS-09-008

A video demonstrating this exploit can be found at:
http://www.senseofsecurity.com.au/movies/SOS-09-008-safenet.mp4

Other Sense of Security advisories can be found at:
http://www.senseofsecurity.com.au/research/it-security-advisories.php

 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2019, SecurityGlobal.net LLC