EMC AutoStart ftAgent Opcode 85 Subcode 22 Parsing Remote Code Execution Vulnerability
ZDI-12-120: July 12th, 2012CVE ID
CVSS Score
Affected Vendors
Affected Products
TippingPoint™ IPS Customer Protection
TippingPoint IPS customers are protected against this vulnerability by Digital Vaccine protection filter ID 12435. For further product information on the TippingPoint IPS:Vulnerability Details
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of EMC Autostart. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the ftAgent.exe service, which listens by default on TCP port 8045. When handling messages with opcode 85 (0x55) and subcode 22 (0x16), the process performs arithmetic on an unvalidated user-supplied value used to determine the size of a new heap buffer, allowing a potential integer wrap to cause a heap buffer overflow. This vulnerability can be leveraged to execute code under the context of the SYSTEM user.
Vendor Response
EMC has issued an update to correct this vulnerability. More details can be found at:Disclosure Timeline
-
2011-11-22 - Vulnerability reported to vendor
2012-07-12 - Coordinated public release of advisory
Credit
This vulnerability was discovered by:-
gwslabs.com
