OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
[SA17947] Appfluent Database IDS "APPFLUENT_HOME" Buffer Overflow

From: Secunia Security Advisories (sec-advsecunia.com)
Date: Fri Dec 16 2005 - 08:47:10 CST

TITLE:
Appfluent Database IDS "APPFLUENT_HOME" Buffer Overflow

SECUNIA ADVISORY ID:
SA17947

VERIFY ADVISORY:
http://secunia.com/advisories/17947/

CRITICAL:
Less critical

IMPACT:
Privilege escalation

WHERE:
Local system

SOFTWARE:
Appfluent Database IDS 2.x
http://secunia.com/product/6546/

DESCRIPTION:
c0ntex has reported a vulnerability Appfluent Database IDS, which can
be exploited by malicious, local users to gain escalated privileges.

The vulnerability is caused due to a boundary error when handling the
APPFLUENT_HOME environment variable. This can be exploited to cause a
stack-based buffer overflow by running the affected file with an
overly long string in the environment variable.

Successful exploitation allows arbitrary code execution with root
privileges, but requires that the user is able to run the affected
binary using sudo, and that sudo is not configured to reset the
environment variables.

The vulnerability has been reported in version 2.0.

SOLUTION:
The vulnerability has reportedly been fixed in version 2.1.0.103.

PROVIDED AND/OR DISCOVERED BY:
c0ntex

ORIGINAL ADVISORY:
http://open-security.org/advisories/14

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/

Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories

----------------------------------------------------------------------