Fujitsu tsworks Attachment Expansion Buffer Overflow May Permit Remote Code Execution
|
|
SecurityTracker Alert ID: 1008144
|
|
CVE Reference: GENERIC-MAP-NOMATCH
(Links to External Site)
|
Date: Nov 11 2003
|
Impact: Execution of arbitrary code via network, User access via network
|
Fix Available: Yes
Vendor Confirmed: Yes
|
Advisory: Secure Net Service (LAC)
|
Version(s): 3.0
|
Description: A buffer overflow vulnerability was reported in Fujitsu's tsworks e-mail client. A remote user can cause arbitrary code to be executed in certain cases.
Secure Net Service (SNS) warned that there is a buffer overflow vulnerability in tsworks that may allow a remote user to execute
arbitrary code on the target system.
A remote user can reportedly send an e-mail message with an attachment that contains an
"unusually long" string of characters to a target user. Then, when the target user attempts to invoke the "Expand the Attachment"
function, the buffer overflow will be triggered, according to the report.
Hisayuki Shinmachi is credited with discovery.
The
original SNS advisory is available at:
http://www.lac.co.jp/security/english/snsadv_e/70_e.html
|
Impact: A remote user can send an attachment that, when expanded by the target user, will execute arbitrary code on the target user's computer. The code will run with the privileges of the target user.
|
Solution: The vendor has reportedly issued a fixed version (3.1), available at:
http://www.hnc.fujitsu.com/products/tsworks/update.html#ver3101
|
Vendor URL: www.hnc.fujitsu.com/products/tsworks/ (Links to External Site)
|
Cause: Boundary error
|
Underlying OS: Windows (Any)
|
|
Message History:
None.
|
Source Message Contents
|
Date: Tue, 11 Nov 2003 00:50:04 -0500
Subject: http://www.lac.co.jp/security/english/snsadv_e/70_e.html
|
http://www.lac.co.jp/security/english/snsadv_e/70_e.html
Secure Net Service issued an advisory warning of a buffer overflow vulnerability in
'tsworks' that may allow a remote user to execute arbitrary code on the target system.
A remote user can send an e-mail message with an attachment that contains an "unusually
long" string of characters to a target user. Then, when the target user attempts to
invoke the "Expand the Attachment" function, the buffer overflow will be triggered.
Version 3.0 is reported to be vulnerable.
The vendor has reportedly issued a fixed version (3.1), available at:
http://www.hnc.fujitsu.com/products/tsworks/update.html#ver3101
Hisayuki Shinmachi is credited with discovery.
|
|
